Dear Provider,

As you are aware the Legal Aid Agency has been managing a cyber security incident, which we notified providers about on 30 April. The investigation into this incident has been ongoing and is a developing picture and those investigating have been working hard to identify the extent and associated risks. Over the course of the last week as you know, we have been taking our services offline overnight to allow Digital teams the opportunity to undertake remedial activity and had planned for services to be offline this weekend.

On Friday 16 May, we discovered the incident was far more extensive than originally understood, with the group behind it also having accessed a large amount of information relating to legal aid applicants. In response to this development we are urging all members of the public who have applied for legal aid since 2010 to safeguard themselves. It is recommended impacted individuals are alert for any suspicious activity such as unknown messages or phone calls and to be extra vigilant to update any potential exposed passwords. As a further precaution, if your staff use their LAA Online Portal password for other systems or services we recommend that they change this password in all locations. For further information on this incident we would ask that you read the statement which has been published on GOV.UK. You will find it at https://www.gov.uk/government/news/legal-aid-agency-data-breach.

We are sorry that this information breach has occurred and for any impact it may have on you and your clients. As you are aware, we are already committed to a significant programme of investment to strengthen our systems and will seeking to accelerate that where possible.

So that we can manage any further risk, and to ensure we can provide confidence to you in the ongoing security of the information they provide to us, following the planned weekend outage we are also currently keeping the LAA Online Portal offline at this time. As with the previous outage, contingency processes should be adopted as set out below. We will provide a further update on access to the system on Thursday.

Civil applications:

For civil applications, where a provider cannot utilise delegated functions and has an imminent court hearing they should contact the LAA customer services team on 0300 200 2020.

Crime applications:

Whilst the Portal is unavailable providers will be unable to gain a date stamp for applications. When the Portal becomes available providers will be invited to complete applications as normal and indicate in the ‘Further Information’ section that they were unable to submit their application and the date that they would have submitted it but for the outage. LAA caseworkers will backdate representation orders to the requested date where applicable.

Crime Lower and Legal Help monthly submissions

Where providers have not yet submitted their April CWA submissions (due by 20 May), they should email the Reconciliation team reconciliation@justice.gov.uk with their total monthly submission value for their April submission by 20 May. This should be a global amount for each submission which the provider normally makes on CWA. When CWA is available, the submissions should then also be submitted via the system, to allow them to be reconciled.

Yours sincerely,

Alistair Adan

Head of Case Management, LAA