Update on Legal Aid ACT cyber attack

Thursday, 10 November 2022

Update on Legal Aid ACT cyber attack

Please visit the Legal Aid website for the latest information.


You will be aware that Legal Aid ACT was subject to a cybercrime on Thursday 2 November 2022.

I can now confirm that a cybercriminal copied client information during that event and this is now a criminal matter.

We are working with our cyber specialist teams to identify exactly what data was copied but that process will take weeks to finalise. However, we wanted to alert you to this crime and the steps we have taken to help protect further risks to our confidential information.

We know that some of your information has been impacted. We do not yet know exactly which files have been stolen. In some cases, if we have identified individuals or organisations who are affected, we have called you directly. For example, we know some invoices from barristers have been included in this data breach.

We are very aware that we hold privileged legal information. We are working closely with the Australian Federal Police and ACT Policing to ensure we provide evidence of this crime without breaching our own obligations to keep matters confidential. As I am sure you can appreciate, this is challenging work, and we are taking our obligations seriously to protect you and our clients.

We moved to a new cloud-based work system which is completely separate to the networks accessed in this incident. Please be patient as our staff learn how to use this system and continue to provide our usual services and support concerned clients.

Unfortunately, this also means that we are not able to continue using the old grants portal.

The Client Services team will ensure funding is made available to you in the new grants portal for any

  1. Unpaid invoices you submitted via the old grants portal – the last payment run was 3 November 2022. You will then need to make a claim in the new grants portal.
  2. Remaining approved extensions in the old portal for work not yet undertaken and/or invoiced.

Client Services will let you know once this work has been completed for your firm.

Further, we are not expecting to make any payments this week, with the next payment run scheduled for 17 November 2022.

I encourage you to visit our website for the latest information as we are doing daily updates to keep the community informed.

John Boersig
CEO, Legal Aid Commission

Resources for members

In the Spring 2021 edition of Ethos, Jen McMillan, Manager of Lawcover’s Practice Support Services, provided some timely advice on how law firms can minimise their cyber risk by implementing a handful of simple measures. You can read the article online.

There are also a number of websites that members can access for further information:

  • The Australian Government’s Australian Cyber Security Centre (ACSC) provides advice and information about how to protect you, your family and your business online.
  • The Professional Indemnity Insurer, Lawcover, provide a significant number of cyber resources on their website.
  • Scamwatch is a website run by the Australian Competition and Consumer Commission (ACCC), and provides information to consumers and small businesses about how to recognise, avoid and report scams.