The Legal Aid Agency (LAA) told legal-aid providers that their bank account numbers and sort codes may have been exposed in its cyber-security incident. Providers should watch for suspicious account activity and independently check any request to change payment or banking details. The LAA is the government body that administers legal aid in England and Wales. Its online services let providers record work and receive government payments.
Table of Contents
- What financial information may be involved
- When the incident occurred
- Check payment changes outside the message
- Does this put provider IT systems at risk?
- What the payment review found
What financial information may be involved
On 30 April 2025, the LAA told providers that financial details may have been exposed, including bank account numbers and sort codes, according to the Ministry of Justice and LAA FAQ. That wording matters.
It identifies a possible exposure of payment details, but it does not say every provider's bank data was accessed or that the information has been misused. Bank account numbers and sort codes can make a convincing fraud attempt more believable. Treat unexpected messages about remittances, new bank details, refunds, or payment holds with particular care.
When the incident occurred
The LAA discovered the cyber-attack on 23 April 2025. Its later investigation found that attackers had breached systems from December 2024 and began taking data from January 2025, as reported in the LAA annual report. The payment connection explains why providers should pay attention.
The affected online services are used to log legal-aid work and receive government payments, according to the LAA and Ministry of Justice incident announcement. This does not turn an ordinary payment query into proof of fraud. It does mean payment-related contact deserves a controlled verification process.
Check payment changes outside the message
Review the bank account used for LAA payments and the internal process for changing provider bank details. Make sure staff know who can approve a change and how they must confirm it.
Use these practical checks: The LAA advises providers to remain vigilant, while the NCSC explains that breached information can make phishing emails and calls look more genuine. The LAA FAQ and NCSC breach guidance support treating unexpected contact as something to verify, not automatically trust.
- Review account transactions and payment notifications for unexpected activity.
- Verify LAA, bank, or breach-related contact using contact details obtained independently.
- Do not rely on a phone number, reply address, or link supplied in an unexpected message.
- Escalate a proposed bank-detail change through a second person or established approval route.
Does this put provider IT systems at risk?
The LAA says the incident does not create a direct risk to provider IT systems. It states that there is no direct connection from LAA systems to provider systems; the connection is one-way from provider to LAA.
That distinction is useful. A provider does not need to assume its own network was compromised solely because it uses LAA services. It should still follow its normal security controls, especially around accounts used to receive or authorise payments.
What the payment review found
The Ministry of Justice auditor considered fraudulent claims or payments a risk because attackers accessed systems used to process provider payments. The auditor examined changes to provider bank details made after December 2024 and reported no material misstatements in its testing, according to the Ministry of Justice annual report. That is reassurance about the auditor's tested payment records, not a reason to stop monitoring.
A fraudster may instead try to persuade a provider's staff to change records or disclose further information. Providers have no contractual obligation to report this incident to the ICO or notify clients, the LAA says. The FAQ states that the Ministry of Justice is the data controller holding the affected data and has notified the ICO.
You Might Also Like
- Legal Aid Agency Data Breach: What Applicants in England and Wales Should Check
- Legal Aid Agency Data Breach: Why the Affected Application Period Now Starts in 2007
- Legal Aid Agency Data Breach: Why Criminal History and Financial Records Raise Different Risks