Legal Aid Agency hit by cyber security incident

The government agency responsible for overseeing billions of pounds worth of legal funding has been hit by a cyber security incident.

The Ministry of Justice (MoJ) said it is working with the National Crime Agency and National Cyber Security Centre to investigate the data breach.

In a letter sent to law firms last week, which has been seen by Sky News, the Legal Aid Agency (LAA) warned it had identified a "security incident".

The organisation, which provides legal aid in civil and criminal cases in England and Wales, said "it is possible that financial information relating to legal aid providers may have been accessed by a third party".

The LAA said it could not confirm "what, if any, information was accessed", but said it was "possible that payment information may have been accessed".

There are nearly 2,000 providers, including solicitors' firms, barristers, not-for-profit organisations and telephone operators, contracted to deliver legal aid services in England and Wales, according to government data.

The LAA, which is an executive agency, sponsored by the MoJ, is responsible for administering legal aid funding, which was around £2.3bn in 2023/24.

Law firms are an attractive target for cyber attacks because they hold sensitive client information and handle large sums of money.

"This incident is being investigated in accordance with our data security processes, and action has been taken to mitigate the incident," the letter said.

"I would like to offer our sincere apologies for any concern this may cause you.

"The LAA takes the security of the information we hold seriously, and we understand the potential impact any breach can have on you."

The public body's head office is in London but it has others in towns and cities across England and Wales and employs around 1,250 staff.

An MoJ spokesperson said: "We take any data breach extremely seriously and have already taken action to bolster the security of the legal aid system.

"We're working with the National Crime Agency and National Cyber Security Centre to investigate the situation, and it would be inappropriate to comment further at this stage."

A National Crime Agency spokesperson said: "We are aware of a cyber incident affecting the Legal Aid Agency.

"NCA officers are working alongside partners in the National Cyber Security Centre and MoJ to better understand the incident and support the department."

It comes after retailers Co-op, Harrods and Marks & Spencer were hit by cyber attacks, although there is no suggestion that there is any connection to the incident involving the LAA.