UK Ministry of Justice Spent £50 Million on Cybersecurity Yet Faced Major Attack

The UK Ministry of Justice (MoJ) allocated £50 million to enhance cybersecurity at the Legal Aid Agency (LAA) before a major cyberattack that was disclosed in 2025. The attack, which began on December 31, 2024, was not detected until April 2025, raising concerns about the effectiveness of the security measures in place. Government officials noted that the LAA had identified security weaknesses on its risk register since 2021, with a risk rating for cyberattacks deemed ‘extremely high.’

Despite the substantial investment, the LAA’s new threat detection system, funded as part of the £10.5 million allocation, only identified the intrusion in April 2025, after it had already been ongoing for several months. The delay in detecting the attack and the subsequent lag in taking servers offline until May 2025 further exacerbated the situation.

Initially, the LAA believed that only the data of legal aid providers had been compromised, but it later became clear that sensitive information related to legal aid applicants was also at risk. This revelation came on May 16, 2025, prompting immediate actions such as taking systems offline and seeking an injunction to prevent the publication of compromised data.

The impact of the attack on the legal sector was severe, with the LAA implementing contingency plans to maintain access to legal aid while managing the fallout from the breach. Although no legal aid providers left the market, the operational disruptions had a significant effect on workers’ wellbeing, as they had to adapt to more manual processes.

In light of the attack, MoJ permanent secretary Dr. Jo Farrar indicated that further funding would likely be necessary to fully transform the LAA’s IT systems. The department is aware of its vulnerabilities and is committed to addressing them, but the pace of improvements will depend on budget allocations.

Implications for Cybersecurity Practices

This incident underscores the critical importance of not only investing in cybersecurity but also ensuring that systems are effectively monitored and updated. Organizations should take note of the LAA’s experience in handling sensitive data and the potential consequences of delayed detection and response.

Users and organizations must remain vigilant about their cybersecurity posture, particularly in sectors handling sensitive information. Regular assessments of risk management strategies and timely updates to security protocols can help mitigate the risks of similar attacks.

• Legal Aid Agency: The agency faced a significant cyberattack that compromised sensitive data.
• Ministry of Justice: The MoJ invested £50 million in cybersecurity improvements but struggled with effective implementation.
• Threat Detection System: A new system was implemented but only detected the attack after several months.
• Contingency Plans: The LAA enacted plans to maintain legal aid access despite operational disruptions.
• Budget Allocations: Future cybersecurity improvements depend on available funding and prioritization.