Legal Aid Agency cyber attackers said to be in ‘known hacking group’, court told

A cyber attack on the Legal Aid Agency was carried out by people claiming to be part of a “known hacking group”, the High Court has heard.

A “significant amount of personal data” of people who applied to the agency since 2010 was accessed and downloaded in April this year, the Ministry of Justice (MoJ) previously said.

Lawyers for the MoJ successfully sought an injunction made on May 18, which required the people “threatening to disclose information wrongly extracted” from the Legal Aid Agency (LAA)’s IT systems to identify themselves and hand over the information without publishing it.

At a hearing on Wednesday, lawyers for the department made a bid to continue the order.

Pseudonym

Tom Richards KC told the court in London: “The defendants are persons unknown, they claim membership of a known hacking group but continue to hide behind a pseudonym, despite a court order requiring them to identify themselves.”

Asked by judge Mr Justice Swift why the group is not named in some court documents, Mr Richards said: “The reason not to name them in a public document is so not to give publicity to the group and thereby notoriety, increasing the leverage they may have against this claimant or other organisations in due course.”

Mr Richards said in written submissions that the alleged hackers have said they will not comply with the court order because they are abroad.

The UK Government became aware of a cyber attack on the LAA’s online digital services on April 23, but realised on May 16 it was more extensive than originally thought.

Details

The data accessed may include contact details and addresses of legal aid applicants, their dates of birth, national insurance numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments.

In a judgment on Wednesday afternoon, Mr Justice Swift said the order should continue and that it “serves a real public objective”.