Select committee: Public Accounts Committee
Conclusion 25
59th Report - Ministry of Justice follow-up: Autumn 2025
Published 7 Jan 2026
Addressed to HM Treasury
Public Accounts Committee Ministry of Justice follow-up: Autumn 2025 All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
We asked LAA why it had taken so long to detect the attack and to then take systems offline.48 LAA explained that the risk of a cyberattack on its systems had been rated as extremely high on MoJ’s risk registers since 2021. It told us that MoJ had subsequently provided over £50 million in total to help address some of the system issues and improve security, which allowed it to implement a new security monitoring service.49 It explained that it was 42 Qq 62, 65 43 Q 58 44 Law Society of England and Wales (MOJ0002); Public Law Project (MOJ0004); The Law Centres Network (MOJ0008) 45 Law Society of England and Wales (MOJ0002) 46 Q 70 47 Q 70 48 Q 71 49 Qq 71, 96 15 this new service which meant it was able to detect the breach in April 2025. On the delay to taking its systems down, LAA told us that discussions at senior levels around the trade-offs between access to justice and the risks posed by the cyberattack were ongoing between April and May 2025. However, it said that it did not discover the full extent of the attack—that a large amount of information relating to legal aid applicants may also have been accessed—until 16 May 2025, at which point it took systems offline.50
From: Public Accounts Committee, 59th Report - Ministry of Justice follow-up: Autumn 2025 (HC 1240), 7 January 2026
Government response
The government responded to the whole report on 1 April 2026 (deadline 7 March 2026).
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "agrees with the Committee's recommendation" on each of the recommendations in the response, reporting some as implemented and giving target dates for others.
- On Dartmoor, HMPPS has reviewed its handling of the lease negotiations and identified areas of learning. MoJ and HMPPS will write to the Committee "once the proposed approach to remediating Dartmoor has been decided", with a target date of June 2026.
- On access to legal aid for the digitally excluded, an Ipsos civil demand feasibility study will report by the end of March 2026. The department will report back to the Committee on progress in October 2026.
- On market sustainability, the department will "explore options to routinely monitor the profitability of legal aid firms" and update the Committee in October 2026. Any future policy decisions will be "in the context of the department's spending review settlement".
- On the cyberattack, MoJ and LAA say lessons have already been shared across government. MoJ states that it "has allocated funding to the transformation of LAA systems over the 2026-2029 period".