The cyber attack on the Legal Aid Agency was not an attack on a law firm. It still hit law firms hard: the people they represent had their most sensitive data stolen, and the firms lost the system they use to get paid.
What happened
On 23 April 2025, the Ministry of Justice detected unusual activity in the Legal Aid Agency's IT systems. On 16 May, the LAA discovered that the attack was more extensive than first thought and took its online services offline. Three days later it confirmed that applicants' data "from 2010 onwards" might have been stolen. That range was later revised back to 2007, and according to reporting in October 2026, around 250,000 records predate 2007, with the earliest verified record dating from 1978.
The stolen data is about as sensitive as personal data gets: contact details, addresses, dates of birth, National Insurance numbers, criminal history, employment status and financial information such as contribution amounts, debts and payments. Some records also include applicants' partners. Provider data, including contracts, financial information and portal login names and email addresses, was also affected.
The attackers claimed to hold 2.1 million pieces of data. The Ministry of Justice has not verified that figure, and has said there is currently no evidence that the data has been published. An injunction prohibits sharing it.
The impact on law firms
The digital services that legal aid providers use to log work and get paid were taken offline. Contingency arrangements began on 27 June 2025, and a phased return of the case management system started only on 24 November 2025. The Law Society's president said firms were "operating on the margins of financial viability", and some struggled to cover salaries.
The ICO was notified and made enquiries, and the National Crime Agency and NCSC were involved. The Ministry of Justice has said it is investing more than £200 million in digital services and cybersecurity.
Why it matters
Two lessons apply far beyond legal aid. First, your firm's exposure includes systems you do not control. A breach at a government agency, a case management provider or a document platform can expose your clients and stop your cash flow. Second, the attackers went after records that were years or decades old. Old data that nobody needs is still data that can be stolen.
What to do now
- Map your critical third parties, including government portals and software suppliers, and decide what you would do if each one disappeared for three months.
- Assume portal credentials may be exposed. Use unique passwords and MFA for every external portal, and change them after any supplier breach.
- Apply retention rules. Delete or archive offline the client data you are no longer required to keep.
- Watch for phishing that uses the breach. Clients and staff may receive convincing messages referring to legal aid matters.
- Keep a manual fallback for billing, time recording and client contact.
How Blacknote helps
We help firms assess third-party risk, plan for supplier outages and respond when a supplier breach puts client data at risk, including coordinating with your data protection lawyers on whether and how to notify clients.
Sources
- The Law Society: Legal Aid Agency data breach
- BleepingComputer: UK Legal Aid Agency hackers stole records dating back to 1978
- LBC: Significant data including criminal records stolen in cyber attack on Legal Aid
- Government Technology: Legal Aid Agency cyber attack
- teiss: Legal Aid Agency cyber attack, what we know now