Legal Aid Agency data breach: information for members

What we know

According to the LAA, a significant amount of personal data belonging to individuals who applied for legal aid through its digital service from 2010 onwards may have been stolen.

The LAA’s online portal is currently offline until 22 May 2025 as a precaution.

“It is extremely concerning that members of the public have had their personal data compromised in this cybersecurity incident and the LAA must get a grip on the situation immediately,” said Law Society president Richard Atkinson.

“It is the LAA’s responsibility to contact all the legal aid applicants whose data has been compromised.”

What legal aid providers should do

We continue to emphasise the need for the LAA to provide clear and timely information to legal aid providers and to take urgent steps to prevent future breaches.

All providers should have received guidance directly from the LAA around what to do while the online portal is unavailable. This includes:

• Civil applications: if you cannot use delegated functions and have an imminent court hearing, contact the LAA customer services team on 0300 200 2020
• Crime applications: providers are currently unable to gain date stamps for applications. When applications can be submitted via the portal again, include the intended submission date in the ‘Further information’ section and LAA caseworkers will backdate as appropriate
• Crime Lower and Legal Help monthly submissions: if you haven’t submitted your April CWA data, email your total monthly submission value to reconcilitation@justice.gov.uk by 20 May

Further information can be found here.

If your clients’ personal data may have been affected, the National Cyber Security Centre (NCSC) also has guidance on how to respond to a data breach.

We’ll update this page with further guidance as soon as more information becomes available.

Impact on legal aid providers

“Legal aid firms are small businesses providing an important public service and are operating on the margins of financial viability.

“Given that vulnerability, these financial security concerns are the last thing they need,” said Richard.

At the current time the LAA is unable to field queries from individuals about the impact of the breach.