A significant amount of personal data has been accessed and downloaded from Legal Aid digital services since 2010, the UK government has revealed. The service through which legal aid providers can log their work and receive payment from the Government was compromised and left undiscovered until Wednesday 23rd April 2025. Upon the discovery, the government says it took immediate action to stop any more damage being done, amending the security of the system and informing all legal aid providers that some of their personal data had been lost, including contact details, addresses, applicant’s dates of birth, national ID numbers, financial information, criminal history and employment status. The government’s cyberattack has been described as “one of the most devastating against the UK in 2025” according to Dr. Ilia Kolochenko, CEO at ImmuniWeb, and a Fellow at the British Computer Society.
Its repercussions are “stigmatizing, long-lasting” and cause perceptible harm to the legal aid applicants affected, due to the large amount of sensitive information that criminals managed to obtain. However, Dr. Kolochenko also said it would be too premature to make conclusions whether any human negligence was to blame in the case.
The extent of the attack is more extensive than originally thought, prompting the government to create a management plan with the National Crime Agency and National Cyber Security Centre.
The agencies believe the group were able to obtain a significant amount of data from those who applied online for legal aid dating back to 2010.
“Whilst majority of the victims likely belong to the most vulnerable and insolvent social groups, it is also possible that some aid seekers from, say, 2010 have since then become politicians, successful entrepreneurs, journalists, or other highly attractive victims for organized cybercrime”.
All members of the public who have applied for legal aid in the past are urged to take steps to safeguard themselves and stay vigilant of any suspicious activity.
Jane Harbottle, Chief Executive Officer of the Legal Aid Agency, issued an apology for the attack, expressing her shock and commenting:
“It has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down.
We have put in place the necessary contingency plans to ensure those most in need of legal support and advice can continue to access the help they need during this time”.
