Ministry of Justice splurged £50M on security – still missed Legal Aid Agency cyberattack

The Public Accounts Committee report details a high-impact cyberattack on the Legal Aid Agency that began on 31 December 2024 but went undetected until April 2025, potentially exposing large volumes of sensitive legal aid applicant data. The MoJ had previously allocated £50 million for security improvements; detection and response delays caused significant operational disruption across the legal sector, required contingency payments to providers, and prompted calls for further funding and accelerated IT transformation.