As we are a legal aid contract holder, the Legal Aid Agency (LAA) told us by email on Monday 19 May 2025 that its online systems had been hacked and a significant amount of personal data in respect of members of the public who applied for legal aid, going back to 2010, has been downloaded by an unknown third party

You can read the full press release that was issued by the LAA today here: https://www.gov.uk/government/news/legal-aid-agency-data-breach

The LAA says in the release that it became aware of a cyber-attack on its online digital services on 23 April but believed at that point the breach involved financial information about legal aid providers themselves, not client data. We were first told about this on 30 April by email

However, the LAA has now confirmed the breach included data on members of the public who applied for legal aid since 2010 also, and this data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments

The LAA urges all members of the public who have applied for legal aid since 2010 to take steps to safeguard themselves. The LAA recommends those affected be alert for any suspicious activity such as unknown messages or phone calls and to be extra vigilant to update any potentially exposed passwords. And if in any doubt when communicating with anyone online or over the phone, to verify their identity independently before providing any information to them

At present we do not know whether the LAA will be writing to those affected or whether it has in fact already done so.

Thank you for your understanding.