Anyone who applied for legal aid in England or Wales through the Legal Aid Agency’s online service between 2007 and May 16, 2025 may have had personal data taken in the cyber-attack on the agency. According to the agency, that data may include criminal history, financial details and home address. There is no settlement or compensation scheme, and nothing to file. The agency’s advice is to watch for suspicious calls and messages, change passwords that may have been exposed, and check the identity of anyone who contacts you asking for information.
Status: UK government data breach; systems restored | No settlement, fund or claim form — UK group litigation announced, nothing decided
Protect Yourself Now
- Treat unexpected contact with suspicion. The agency announced the breach publicly on May 19, 2025 instead of writing to each applicant. Anyone who says they are contacting you personally about it deserves a second look.
- Change passwords that may have been exposed.
- Verify who you are dealing with. Before you give out information, confirm the caller or sender’s identity through an independent channel.
- Use official information. The Ministry of Justice keeps current guidance on its GOV.UK Legal Aid Agency cyber security incident page.
What the Attackers Could See
The agency says the group accessed and downloaded a significant amount of personal data about people who applied through its digital service. The categories it named are:
- contact details and addresses;
- dates of birth;
- national ID numbers;
- criminal history;
- employment status; and
- financial data such as contribution amounts, debts and payments.
In some cases, information about applicants’ partners may also be included. Early reports put the affected period at 2010 onward, but the agency later found the records went back three more years, to 2007.
The breach is serious mainly because of who was affected. Legal aid applicants include people in criminal proceedings, people in family court, people at risk of losing their homes and victims of domestic abuse. A record that links a name and current address to criminal history and money troubles is far more dangerous than a leaked email list.
How Many People?
No official number exists. The government has only ever described it as a significant amount of personal data. The widely repeated figure of about 2.1 million records comes from a claim attributed to the attackers and reported in the press, and the government has not verified it. That figure is the attackers’ own assertion, not an official count.
Four Months Undetected
| December 2024 | Attackers first get into the agency’s systems. |
| January 2025 | Data starts being taken out. |
| April 23, 2025 | The Ministry of Justice becomes aware of the attack and warns legal aid providers that some of their details, including financial information, may be compromised. |
| May 16, 2025 | The agency finds the attack was more extensive than first understood and reached applicant data. Systems taken offline. |
| May 19, 2025 | Breach announced publicly, with a statement to the House of Commons. |
| January 2026 | The Public Accounts Committee reports the December 2024 intrusion date. |
The Public Accounts Committee also found the ministry knew the system was fragile. Weaknesses in the agency’s systems had been on the Ministry of Justice risk register since 2021, and officials told MPs the cyber-attack risk rating had been extremely high. More than £50 million went into transforming and stabilising the systems, in rounds reported at £8.5 million, £10.5 million and £32 million. The committee concluded the spending produced real improvements, including the upgrades that let the agency detect the breach at all, but not enough of them and not in time.
The Response So Far
The Ministry of Justice worked with the National Crime Agency and the National Cyber Security Centre and notified the Information Commissioner’s Office, the UK data protection regulator. In May and June 2025 it obtained an injunction prohibiting the unlawful use, disclosure or publication of information taken from the systems. In its latest guidance, the ministry says it has no indication the data has been released and is continuing to monitor.
Restoring services took months:
- Crime Apply and the crime forms came back. Temporary arrangements that let providers grant representation under delegated authority ended September 30, 2025.
- Civil work returned through the Client and Cost Management System, and the interim Average Payment for Civil Representation scheme has closed.
- Submit a Bulk Claim went live on February 4, 2026.
The department’s guidance now says the online services providing key functionality are available and the contingency processes have been archived.
Compensation Is Undecided
Several UK law firms have said they are preparing group litigation in the High Court for affected applicants. In England and Wales that would usually proceed under a Group Litigation Order. That is an opt-in process: affected people each instruct a solicitor and are added to a managed group. A U.S. data breach class action works differently, including everyone who fits the class definition unless they opt out. No court has decided anything, no liability has been established, and the Information Commissioner’s Office has not announced any enforcement outcome against the Ministry of Justice.
Nobody in the United States is affected. The agency handles legal aid only in England and Wales, and every compromised record came from an application to that service. U.S. legal aid runs through the Legal Services Corporation and state and local providers, none of which was involved. U.S. readers looking for breach settlements they can claim can check OpenClassActions.com’s open data breach settlements. Its Legal Aid Agency breach report has the full timeline.
Frequently Asked Questions
Who was affected by the Legal Aid Agency data breach?
People who applied for legal aid through the agency’s online service in England and Wales between 2007 and May 16, 2025. Some records may include applicants’ partners. Legal aid providers were separately told some of their details, including financial information, may have been compromised.
What data was taken in the Legal Aid Agency hack?
The agency said it may include contact details and addresses, dates of birth, national ID numbers, criminal history, employment status, and financial data such as contribution amounts, debts and payments.
Can I claim compensation for the Legal Aid Agency breach?
There is no settlement, fund, administrator, claim form or deadline. UK solicitors have said they are preparing group litigation in the High Court, but nothing has been decided and no court has ordered compensation.
How many people were affected?
The government has not given a number. A figure of about 2.1 million records comes from a claim attributed to the attackers and has not been verified by the government.
How long were hackers inside the Legal Aid Agency systems?
About four months. The systems were breached in December 2024 and data was taken from January 2025, but the attack was not detected until April 23, 2025, according to the Public Accounts Committee.
Does the breach affect anyone in the United States?
No. The Legal Aid Agency serves England and Wales only, and the compromised records come from applications to that service.
Sources
- Legal Aid Agency and Ministry of Justice — “Legal Aid Agency cyber security incident” guidance (GOV.UK), including the injunction and system restoration updates.
- Legal Aid Agency and Ministry of Justice — “Legal Aid Agency data breach,” news story, May 19, 2025 (GOV.UK); and the incident FAQ.
- Hansard — oral statement by Sarah Sackman MP on the Legal Aid Agency cyber-security incident, House of Commons, May 19, 2025.
- Committee of Public Accounts — “Ministry of Justice follow-up: Autumn 2025,” reported January 2026.
- National Cyber Security Centre — guidance on protecting yourself after a data breach.
- OpenClassActions.com — Legal Aid Agency Data Breach: Hackers Were Inside for Four Months Before Anyone Noticed
Source and credit: this report builds on our sister site’s coverage — OpenClassActions.com: Legal Aid Agency Data Breach: Hackers Were Inside for Four Months Before Anyone Noticed — which follows the case and is updated as new filings, orders and payment news come in.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm, and is not affiliated with any party to the matters described. Allegations are allegations until a court rules on them, and court schedules and outcomes can change.