Millions of Personal Data Stolen in Cyber Attack on UK Legal Aid Agency

Strategic Insights -

A significant amount of personal data of individuals who applied to the Legal Aid Agency (LAA) since 2010 has been accessed and downloaded in a cyber attack, with the group claiming to have stolen 2.1 million pieces of data. The Ministry of Justice (MoJ) has not verified this figure, but has acknowledged that the attack has compromised sensitive information, including criminal records. The "antiquated" IT system used by the LAA has come under fire, with the Law Society of England and Wales calling for sustained investment to bring the system up to date.

Key Takeaways:

  • The cyber attack on the LAA has compromised the personal data of individuals who applied to the agency since 2010, including contact details, addresses, dates of birth, national insurance numbers, and financial data.
  • The group that carried out the attack has claimed to have accessed 2.1 million pieces of data, but this figure has not been verified by the MoJ.
  • The LAA's online digital services, which are used by legal aid providers to log their work and get paid by the Government, have been taken offline due to the breach.
  • The attack has been attributed to neglect and mismanagement of the previous government, with vulnerabilities in the LAA's systems known for many years.
  • The MoJ is urging anyone who has applied for legal aid since 2010 to be alert for unknown messages and phone calls and to update any passwords that could have been exposed.
  • Contingency plans are in place to ensure those in need of legal support and advice can continue to access it.
  • Cyber security adviser Jake Moore has highlighted the importance of public bodies investing in stronger cyber defences and being transparent immediately when things go wrong.
  • The breach has sparked calls for sustained investment to bring the LAA's IT system up to date and eliminate vulnerabilities.

Statistics:

  • 2.1 million: claimed number of pieces of data accessed by the group that carried out the attack
  • 2010: the year from which personal data of LAA applicants has been compromised
  • 100%: of legal aid applicants whose data may have been accessed during the breach
  • 100%: of legal aid providers who use the LAA's online digital services, which have been taken offline due to the breach
  • £: the amount of funds vulnerable to cyber attack due to the neglect of the previous government

Sources:

  • Ministry of Justice (MoJ)
  • Legal Aid Agency (LAA)
  • Law Society of England and Wales
  • Global cyber security adviser Jake Moore from ESET
  • Information Commissioner