Data Breach by the Ministry of Justice and Legal Aid Agency

Data Breach by the Ministry of Justice and Legal Aid Agency

‍

The Legal Aid Agency (LAA) is an Executive Agency of the Ministry of Justice. When we provide legal aid to a client, we are obliged to share information and sometimes documents with LAA through a LAA portal.  

On 30 April 2025, LAA announced that there had been a cyber attack on that portal. On 16 May 2025, LAA stated that the hackers had “accessed a large amount of information relating to legal aid applicants”. LAA have not provided information more specific than that.  

LAA have stated that they and the Ministry of Justice are the data controllers with legal responsibility for this breach.  

‍

What Kind of Data Might Be Affected?

There is not enough information coming from LAA to enable us to know what data has been leaked.

However it could include -  

- Personal identification information: Your name, address, date of birth, and contact details.

- Financial information: Details about your income, benefits, and financial circumstances provided for legal aid eligibility assessments.

- Case-related information: Details about your legal matter, including sensitive information related to your case.

- Correspondence: Letters, emails, and other communications with the LAA.

What Should You Do Now?

While the full details of the breach are being established by the LAA/MoJ, we still advise you to take the following precautionary steps to protect yourself:

- Stay Informed: The Legal Aid Agency and Ministry of Justice will likely be issuing updates and guidance as their investigation progresses. Please monitor official GOV.UK announcements and any communications they send out.  

- Be Vigilant for Suspicious Activity: Be extra cautious about any unsolicited emails, calls, or messages you receive. Do not click on links or provide personal information unless you are absolutely sure of the sender's identity. Cybercriminals may try to exploit data breaches by sending phishing emails or other scams using information potentially obtained in a breach.

- Example: Be wary of emails asking you to urgently update your account details or threatening action if you don't provide information. Always verify the authenticity of such requests through official channels.

- Monitor Your Bank Accounts and Credit Reports: Keep a close eye on your bank and credit card statements for any unusual or unauthorised transactions. If you notice anything suspicious, report it immediately to your bank or credit card provider. You are entitled to check your credit report for free from the three main Credit Reference Agencies in the UK: Experian, Equifax, and TransUnion.

- Report Suspicious Communications: If you receive any communication that seems suspicious or appears to be related to the data breach, even if it purports to be from the Legal Aid Agency, the MoJ, or any legal body, please report it to Action Fraud, the UK's national reporting centre for fraud and cybercrime. You can do this online or by calling 0300 123 2040.

‍

More information

If you have any specific concerns about this, you can contact LAA directly Their number is 0300 200 2020 and the relevant email address is dataprotection@justice.gov.uk

‍