Last month’s cyber-attack on the Legal Aid Agency (LAA), which saw criminals access data relating to hundreds of thousands of people, reinforces the need for businesses across every sector to conduct regular risk assessments to ensure their systems are secure. 

The Ministry of Justice (MoJ) revealed in a statement on 19 May that it had become aware of a cyber-attack on the LAA’s online digital platform, which is the service through which legal aid providers log their work and receive payment from the government. 

In the attack, hackers managed to access and download a significant amount of personal data from those who applied for legal aid through the LAA’s digital service since 2010. 

Stolen data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments, said the government.  

The LAA immediately took steps to bolster the security of the system. However, as more details of the attack came to light, the executive agency, which provides civil and criminal legal aid and advice in England and Wales to help people deal with their legal problems, was eventually forced to take down the entire online service. 

Commenting on the cyber-attack, Jane Harbottle, Chief Executive Officer of the LAA, said: “I understand this news will be shocking and upsetting for people and I am extremely sorry this has happened. 

“Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems so we can safely continue the vital work of the agency. 

“However, it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down.” 

The government has urged people whose data might have been compromised in the cyber-attack to remain vigilant. 

“We would urge all members of the public who have applied for legal aid in this time period to take steps to safeguard themselves,” said the government’s statement. 

“We would recommend you are alert for any suspicious activity such as unknown messages or phone calls and to be extra vigilant to update any potentially exposed passwords.  

“If you are in doubt about anyone you are communicating with online or over the phone you should verify their identity independently before providing any information to them,” advised the MoJ. 

The attack reinforces the need for all businesses to conduct regular risk assessments to ensure company systems are not vulnerable to attack.  

To minimise the risk and impact of a cyber-attack, firms should also: 

• Undertake thorough data protection impact assessments. 

• Conduct effective due diligence on suppliers. 

• Put in place appropriate security measures. 

• Make clear and complete contractual agreements. 

• Ensure data protection officers have the adequate authority, resources and independence to oversee supplier compliance, conduct audits and enforce corrective actions. 

Sarah Sackman MP, Minister of State for Courts and Legal Services, said the “data breach was made possible by the long years of neglect and mismanagement of the justice system under the last Conservative Government. They knew about the vulnerabilities of the Legal Aid Agency digital systems, but did not act”. 

The cyber-attack on the LAA is the latest in a series of data breaches on organisations in the UK that have occurred over the past few months. 

Retail giant Marks and Spencer (M&S) announced in April that it had experienced a cyber-attack over the Easter weekend, causing the company to pause online orders and lose out on millions of pounds in sales.  

Harrods and the Co-op have also both suffered cyber-attacks in recent weeks, causing severe disruption to business.  

AML Compliance for Regulated Businesses 

At the Regulation & Compliance Office (RACO), we help solicitors, accountants, estate agents and other regulated businesses undertake a review of their policies, controls, and procedures to ensure that they are compliant with AML regulations and, therefore, avoid any breaches. 

A review of this nature provides valuable insight into a business when performed correctly. Along with an overview of risk, these crucial assessments also highlight issues within the business, so it is essential to undertake a proper review. All of a company’s building blocks must be considered, including its staff, clients, operations, and finances. 

By working with RACO, a business can be assured that we will bring the required level of knowledge and expertise needed to perform the review, which adds value to the business and is not simply a box-ticking exercise. Our team can also provide a full range of services that include: 

• Consultancy. 

• Compliance Policies. 

• Training. 

• Handbooks. 

• Auditing. 

Our services focus on businesses’ anti-money laundering and regulatory requirements through the implementation of effective policies, procedures, training, and consultancy. We also provide continued monitoring of staff and ongoing training to ensure that everyone within a business is aware of the latest requirements and complies with their responsibilities. 

We offer a full range of services focused on ensuring businesses across all regulated sectors create, maintain and evidence their compliance with the requirements of their regulators and legislation. We work with businesses of all sizes, from the smaller high street or niche businesses to the large multi-office and multinationals. 

Get In Touch 

We adopt a sensible and pragmatic approach to fees, ensuring we are competitive and always add value. As necessary, we will agree on packaged services to control cost and enable clients to spread payments to alleviate cash flow, yet ensure services are provided when needed. 

If you want to discuss our services in more detail, contact us at 0203 985 8550, email us at info@regulationandcomplianceoffice.co.uk or complete an enquiry form.