Legal Aid Agency Cyber-security Incident 2025-05-19

The shadow minister criticises the delay in notifying the public and questions the Government's response. He asks about the timeline for system restoration, origin of the attack, risk assessment of other systems, improvements to be achieved with £20 million funding, and commitment to transparency and support for affected individuals.

The Minister explained that when Ministers were first informed about the exposure of the Legal Aid Agency’s digital platforms to a risk, they did not have full information on its extent and nature. At that point, the responsibility to keep the legal aid system running outweighed informing the House. The system has been closed down to prevent further data breaches, and contingency plans are in place for those needing legal support. The Government will invest £20 million to stabilise and transform the service, partly due to prior investments which helped detect the threat. Transparency will be provided through a written update.

The shadow Minister highlighted that this data breach is one of the most serious in recent years, affecting numerous vulnerable individuals. He questioned the scale of the affected people, asked for steps to recover stolen data, and requested regular updates from the Government on rectifying the situation.

The Liberal Democrat spokesperson expressed concern over the breach's impact on trust in the justice system and legal aid users. He asked how the Minister will proactively communicate with affected individuals, consider launching a dedicated advice line, ensure continued access to legal aid services, and conduct a cybersecurity review of all systems used by the Government.

The MP pointed out that recent Public Accounts Committee findings showed substantial gaps in understanding IT resilience against cyber-attacks. She urged for an urgent assessment of robustness across all Departments, including legacy systems and the supply chain.

The MP suggested updating the Computer Misuse Act 1990 to enhance cyber-resilience through strengthened legal protections for cybersecurity researchers. The Minister responded by mentioning the upcoming Cyber-Security and Resilience Bill.

The MP expressed shock at the attack's impact on vulnerable individuals in Harlow and asked how residents can protect themselves if their data has been compromised, as well as how they can access legal aid.

Asked about the perpetrators of the cyber-attack, whether they are UK-based or state actors. He also inquired if checks were being made across Government to identify any security breaches that may not yet have been acted on.

Corrected the Minister's statement, pointing out that the UK is at the top of the International Telecommunication Union’s global cyber-security index. He urged the Minister not to talk down the system while acknowledging its vulnerabilities.

Inquired about the learnings from this cyber-attack being applied across Government and public sector, and whether extra steps required to access legal aid or process payments by legal aid providers will be compensated.

Asked why it took a newspaper article for the Minister to come to the House, questioning whether there was more information not being disclosed. She highlighted the severe impact of this cyber-attack on millions of pieces of sensitive personal data.

Asked if the attack encompasses legal aid details from the entirety of the UK, and whether discussions have taken place with the Justice Minister in Northern Ireland. He expressed concern for those feeling vulnerable such as domestic abuse victims.