Over 2.1 million sensitive data records were leaked in a serious cyber attack on the Legal Aid Agency.
On 23 April 2025, the Legal Aid Agency (LAA) suffered a serious cyberattack. While the full extent of the breach wasn’t revealed until almost a month later, on 16 May, we now know that it could have affected everyone who applied for legal aid in England or Wales since 2007.
A well-known hacker group, Scattered Spider, claims to have accessed over 2.1 million sensitive data records, including personal information submitted as part of legal aid applications. It has now also been advised that where applications involved partners of the applicant, their data may have also been accessed.
The information accessed included:
The breach is now under investigation by regulators, including the Information Commissioner’s Office (ICO).
“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
While each case is judged on its own merits, there are some things we would typically look for when it comes to when claiming compensation following a data breach, cybercrime or other GDPR violation:
With stolen data, cybercriminals can make purchases using your bank and credit cards, apply for credit in your name, set up fraudulent bank accounts and access your existing online accounts.
GDPR failures, cybercrime and data breaches can have a significant impact on you, both mentally and physically. They can cause or exacerbate anxiety, stress and other psychological conditions.
Your data has value, and organisations must be held to account if they fail to protect your right to data privacy or otherwise do not uphold your GDPR rights.
You don’t need to prove financial loss — the emotional impact of the breach (such as stress or anxiety) could still qualify you for compensation.
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
The Legal Aid Agency became aware of a cyber attack on the 23rd of April 2025. By May, it became clear that the breach was far more extensive than expected, with the incident potentially affecting everyone who accessed legal aid through digital platforms since 2007.
Since the breach, the government has admitted the Legal Aid Agency IT software was not fit for purpose and has been extremely vulnerable to attack for years.
An injunction has been put in place to stop anyone publishing the personal information, and there is no evidence that the data has been published anywhere yet.
The UK Gov released the following statement on the data breach:
“On Wednesday 23 April, we became aware of a cyber-attack on the Legal Aid Agency’s online digital services.
These are the services through which legal aid providers log their work and receive payment from the Government.
In the days following the discovery, we took immediate action to bolster the security of the system, and informed all legal aid providers that some of their details, including financial information, may have been compromised.
Since then, we have worked closely with the National Crime Agency and National Cyber Security Centre as well as informing the Information Commissioner.
On Friday 16 May we discovered the attack was more extensive than originally understood and that the group behind it had accessed a large amount of information relating to legal aid applicants.
We believe the group accessed and downloaded a significant amount of personal data from those who applied for legal aid through our digital service between 2007 and 16 May 2025 when the systems were taken offline.
This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments. In some instances, information about the partners of legal aid applicants may be included in the compromised data.
We would urge all members of the public who have applied for legal aid in this time period to take steps to safeguard themselves. We would recommend you are alert for any suspicious activity such as unknown messages or phone calls and to be extra vigilant to update any potentially exposed passwords. If you are in doubt about anyone you are communicating with online or over the phone you should verify their identity independently before providing any information to them.
An injunction has been put in place to prohibit sharing of this data. Anyone who does so could be sent to prison.
Further information on how to protect yourself from the impact of a data breach can be found on the NCSC website.“
The Legal Aid Agency should be in touch to notify affected individuals.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you believe that you may have been affected by the CarGurus data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a data breach compensation claim.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
The Court of Appeal has handed down its judgment in Farley v Paymaster, a landmark decision which strengthens the rights of data breach victims
In today’s digital world, personal data has become one of the most valuable commodities—especially for cybercriminals. From financial details to personal information and even login credentials, hackers actively seek out this information to commit fraud, identity theft, and other illegal activities. Stolen data is bought and sold on the dark
In today’s digital landscape, safeguarding personal information is more critical than ever. A data breach occurs when unauthorised individuals gain access to confidential data, leading to potential misuse of sensitive information. This can result in identity theft, financial loss, and a breach of privacy. What is a Data Breach? A
