The government has known since 2021 that legal aid IT systems were vulnerable to attack - but the Legal Aid Agency was able to detect the data breach only because of remedial measures, senior officials have told MPs.

Practitioners have endured months of disruption after hackers targeted LAA systems required to log work and get paid, forcing the agency to take its systems down in May – nearly a month after the LAA became aware of the attack. It has since emerged that hackers breached the system on 31 December 2024. 

Appearing before the House of Commons public accounts committee last week, Dr Jo Farrar, permanent secretary at the Ministry of Justice, said the legal aid system had been on the government’s risk register as a vulnerability since 2021. LAA deputy chief executive Jane Harbottle told the committee the system was rated 'extremely high risk'.

The committee heard that £32m has been spent since 2022 on making the system less vulnerable. Farrar commissioned a review in 2023 to understand and mitigate the risks, which led to £10.5m being spent in 2024/25 for urgent stability work. ‘The system was less vulnerable and in fact the changes we made allowed us to identify the cyber attack early on and take action as a result,’ Farrar said.

Jane Harbottle

Jane Harbottle: System rated 'extremely high risk'

Read more

Following the review, a security monitoring system was installed. Harbottle said the LAA detected the attack on 23 April following routine checks conducted the day before. The system was shut down on 16 May after a notification from the attacker was received.

Harbottle said it was difficult to give a precise number for how many people have been affected because of the way the systems are structured and data is stored. 

‘We have 48 different systems, we’ve got 120 different components, all house various pockets of data. The data appears as a number of transactions, so there’s no whole [legal aid file] that could have been extracted. There is no file. It appears in a series of different transactions in different buckets in different parts of the system,' Harbottle said.