Source · Select Committees · Public Accounts Committee
Recommendation 24
24
Legal Aid Agency cyberattack went undetected for four months before system shutdown
Conclusion
MoJ and LAA acknowledged that the cyberattack on LAA’s online digital services began in December 2024, four months before the LAA detected the attack on 23 April 2025.46 LAA explained that in April, it took action to boost the security of the systems concerned and informed legal aid providers that their bank details may have been compromised. However, it did not take its systems down until 16 May 2025.47
Government Response
A response document is linked to this report, dated 1 April 2026. Response attribution to this conclusion has not been verified. Read the response document ↗