The UK Legal Aid Agency and Ministry of Justice disclosed that a cyberattack on the agency's online digital services was discovered on April 23, 2025 [1]. Officials subsequently stated that the attack was more extensive than initially understood and that threat actors may have accessed and downloaded a significant amount of personal data belonging to legal aid applicants from 2007 until the systems were taken offline [2]. The government urged anyone who applied for legal aid during that period to remain vigilant and confirmed that the Information Commissioner and law enforcement authorities had been notified [2].
Backfill: this event became public on May 19, 2025 and we added it on Nov 10, 2026. It is not a new event.
HighMonitoringBackfillOfficially confirmed
UK Legal Aid Agency Discloses Cyberattack on Digital Services Exposing Applicant Personal Data
1 min read
- Disclosed
- May 19, 2025
- Occurred
- Apr 23, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government
What to do nowOur advice
The government urged anyone who applied for legal aid during that period to remain vigilant and confirmed that the Information Commissioner and law enforcement authorities had been notified [2].
Timeline
Technical details
References
Official / primary1
- [1]
“On Wednesday 23 April, we became aware of a cyber-attack on the Legal Aid Agency’s online digital services.”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.