A report by NordPass and NordStellar revealed that 3,014 passwords belonging to UK civil servants—including those from the Ministry of Justice (MoJ)—were exposed on the dark web. The MoJ was the most affected institution, with 36 unique exposed passwords, many of which were weak, reused, or easily guessable (e.g., '12345678' or 'password'). The breach stemmed from poor cyber hygiene, including password recycling across accounts and failure to enforce strong authentication policies. The exposure poses significant risks not only to the MoJ’s internal operations but also to national security, as compromised credentials could enable unauthorized access to sensitive government systems. Civil servants’ accounts, if hijacked, might facilitate phishing attacks, data leaks, or lateral movement into broader public infrastructure. The incident underscores systemic vulnerabilities in public-sector cybersecurity, where weak password practices jeopardize both employee data and citizen trust. While no direct data theft was confirmed, the potential for escalation—such as targeted attacks on justice systems or exploitation of administrative privileges—remains high. The report urges mandatory password managers, multi-factor authentication (MFA), and regular credential rotation to mitigate future risks.

UK Ministry of Justice Faces Criticism Over £50M Cybersecurity Failures in Legal Aid Agency Breach The UK’s Ministry of Justice (MoJ) spent £50 million ($67 million) on cybersecurity upgrades for the Legal Aid Agency (LAA) before a major cyberattack exposed critical vulnerabilities, according to a report by the Public Accounts Committee (PAC). Despite the investment, the attack—described as one of the most sensitive in British history—went undetected for four months, raising concerns over the MoJ’s risk management. The LAA’s cybersecurity risks had been flagged as "extremely high" on its risk register since 2021, prompting three rounds of funding (£8.5M, £10.5M, and £32M) to address gaps. However, the attack began in December 2024 and was only discovered in April 2025, with servers taken offline nearly a month later in May. A portion of the £10.5M funding was used to deploy a new threat detection system, though its operational timeline remains unclear. The breach’s full scope emerged on May 16, 2025, when investigators confirmed attackers had accessed not only legal aid providers’ financial data but also sensitive information on legal aid applicants. The LAA immediately shut down systems, secured an injunction to prevent data leaks, and activated contingency measures. While no providers exited the market, the disruption forced manual processes, straining legal sector workers and delaying case management. To maintain operations, the LAA issued average monthly payments to providers based on pre-attack data, later recovering funds at a 25% rate—meaning a 20-week contingency period would take 20 months to recoup. MoJ permanent secretary Dr. Jo Farrar acknowledged the LAA may require additional funding to fully modernize its IT systems, though budget allocations remain uncertain. The PAC report criticized the MoJ’s handling of the incident, questioning public confidence in its ability to secure personal data. Farrar defended the department’s efforts, citing a comprehensive review of all systems and ongoing investments to counter increasingly sophisticated threats. However, the attack underscores persistent risks in high-priority government systems.

The employee’s sensitive personal data of UK Ministry of Justice was compromised in an unauthorized access gained to the servers of Justice Academy, an online learning platform used by MoJ. The compromised information includes full name, staff identification information, email address, national insurance number, and details of where they work and with which department or agency. MoJ has reported about 2,152 data breaches and several cyber incidents in the 12 months.