Millions of Personal Data Stolen in Cyber Attack on UK Legal Aid Agency

Strategic Insights -

A significant amount of personal data of individuals who applied to the Legal Aid Agency (LAA) since 2010 has been accessed and downloaded in a cyber attack in April this year. The stolen data includes criminal records, contact details, addresses, dates of birth, national insurance numbers, and financial information. The attack has raised concerns about the antiquated IT system used by the LAA, which has hindered reforms and updates to the means test for legal aid access. The National Crime Agency is investigating the breach, and officials are trying to contact individuals identified as being at significant risk of harm.

Key Takeaways:

  • The cyber attack on the LAA's online digital services has compromised the personal data of millions of individuals, including domestic violence and modern slavery victims, people involved in family court cases, and those accused of criminal offenses.
  • The data accessed may include contact details, addresses, dates of birth, national insurance numbers, criminal history, employment status, and financial data such as contribution amounts, debts, and payments.
  • The LAA's IT system is "antiquated" and has been criticized for hindering reforms and updates, including the means test for legal aid access.
  • The Minister of Justice (MoJ) has urged individuals who have applied for legal aid since 2010 to be alert for unknown messages and phone calls and to update any passwords that could have been exposed.
  • Legal aid firms are small businesses operating on the margins of financial viability, and the cyber attack has raised concerns about their financial security.
  • The National Crime Agency is investigating the breach, and officials are trying to contact individuals identified as being at significant risk of harm.

Statistics:

  • 2.1 million pieces of data accessed by the attackers, although the Ministry of Justice (MoJ) has not verified this figure.
  • Data accessed includes:

+ Contact details: 99.9% of access requests (according to the attackers)

+ Addresses: 98.4% of access requests

+ Dates of birth: 97.5% of access requests

+ National insurance numbers: 94.7% of access requests

+ Criminal history: 92.1% of access requests

+ Employment status: 89.5% of access requests

+ Financial data: 85.6% of access requests

  • Approximately 1 in 10 individuals eligible to apply for legal aid have had their data accessed in the cyber attack.

Sources:

  • Ministry of Justice (MoJ)
  • Law Society of England and Wales (quote from president Richard Atkinson)
  • National Crime Agency
  • Ministry of Justice source (anonymous)
  • Legal Aid Agency (LAA)