Large-scale personal data breach in the UK due to a cyberattack

On Monday, May 19, the UK’s Legal Aid Agency (LAA) reported a cyberattack that stole a “significant” amount of personal data, including criminal records of people who had applied for legal aid since 2010.

Reuters reports this with reference to the agency’s statement. LAA learned about the attack on April 23 and has been working with the National Crime Agency since then.

On Friday, May 16, it turned out that the cyberattack was of a larger scale than previously thought: the attackers gained access to information about applicants, forcing the agency to suspend its online services.

According to the agency, the hackers could have gained access to applicants’ personal data, including addresses, dates of birth, national identification numbers, and financial information, such as the amount of contributions, debts, and payments.

“Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems so we can safely continue the vital work of the agency. However, it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down,” said Jane Harbottle, CEO of the Legal Aid Agency.

Harbottle noted that the agency, which is part of the Ministry of Justice, has backup plans, so people who need legal aid can still get it.

At the end of April, the Dutch military intelligence agency MIVD reported that Russia was stepping up its hybrid attacks aimed at undermining society in the Netherlands and its European allies and that Russian hackers had already targeted the Dutch civil service.

In the same month, it was reported that the French Ministry of Foreign Affairs stated that Russia was responsible for several cyberattacks against the country over the last couple of years, including the hacking of Emmanuel Macron’s election campaign in 2017.