Treat an unexpected message about an old legal-aid application as suspicious until you verify it independently. The Legal Aid Agency, the Ministry of Justice body that administers legal aid in England and Wales, confirmed a cyber-attack affecting its online digital services. The agency says people who applied through its digital service between 2007 and 16 May 2025 may be affected. A message containing accurate personal details can still be an impersonation attempt.
Official resources:
- Read the official guidance from Gov — Use this primary source to verify the official guidance.
- Explore the official data from Gov — Use this primary source to review the underlying data.
Table of Contents
- Who may be affected?
- Why an old application can make a message convincing
- How to check a message safely
- What to do if you already responded
- What the government says about the stolen data
- Frequently Asked Questions
Who may be affected?
The Legal Aid Agency says applicants who used its digital service between 2007 and 16 May 2025 may be affected. In some cases, the information may also include an applicant's partner.
Potentially accessed data includes addresses, contact details, dates of birth, national identification numbers, criminal history, employment status, contribution amounts, debts and payments. The agency separately identifies legal-aid-provider data, including bank-account numbers and sort codes. The agency discovered the cyber-attack on 23 April 2025 and found by 16 May that applicant data was included, according to the Legal Aid Agency and Ministry of Justice announcement.
Why an old application can make a message convincing
A message may mention a previous application, an address, a date of birth or a payment. Those details can make it sound official, but familiarity is not proof that the sender is genuine. The disclosed information may contain enough personal detail to support convincing impersonation attempts.
Treat unexpected requests for passwords, bank details, identity documents or payments as warning signs. Do not continue a conversation simply because the sender knows something about your legal-aid history. Verify the organisation through contact details you find independently.
How to check a message safely
Use these checks before taking action: The agency advises possible victims to watch for unknown messages or calls, update potentially exposed passwords and independently verify anyone requesting information. The government's phishing guidance also recommends forwarding suspicious emails to [email protected] and texts to 7726.
- Do not click links or open attachments in an uncertain message.
- Do not reply with passwords, bank details or other sensitive information.
- Check the sender's address, phone number and wording for inconsistencies.
- Contact the Legal Aid Agency or your legal representative using a trusted, independently found route.
- If the message claims to require urgent action, pause and verify it before responding.
What to do if you already responded
If you entered a password, change it immediately anywhere you reused it. Use a new password for each important account. If you supplied bank or card details, contact your bank immediately through its official channel.
If money was lost, report it to Report Fraud in England or Wales, or to Police Scotland in Scotland. If you received a suspicious email, forward it to [email protected]. Suspicious texts can be reported to 7726. The National Cyber Security Centre's phishing advice sets out these steps for people who have already interacted with a harmful message.
What the government says about the stolen data
The government says it has no indication that the stolen data has been released. It has also obtained injunctions prohibiting unlawful use, disclosure, publication or communication of the data, according to its Legal Aid Agency incident guidance.
That does not make an unexpected message safe to trust. The practical test remains the same: avoid the message's links and contact details, then verify the request through an independent route.
Frequently Asked Questions
Does a message about my old legal-aid application automatically come from the Legal Aid Agency?
No. A message can use genuine personal details and still be an impersonation attempt.
What should I do with a suspicious text?
Do not reply or use its links. Forward the text to 7726.
You Might Also Like
- Legal Aid Agency Data Breach: Why the Affected Application Period Now Starts in 2007
- Legal Aid Agency Data Breach: What Providers Should Know About Bank Account Details
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files