The United Kingdom’s Legal Aid Agency disclosed a major cyber attack on Monday, revealing that a “significant” volume of personal data, including criminal records, was stolen from applicants who sought legal aid since 2010.

The breach, first detected on April 23, prompted the agency to collaborate with the National Crime Agency to investigate.

Further investigation revealed on Friday that the attack was far more extensive than initially thought, compromising sensitive information such as addresses, dates of birth, national ID numbers, and financial details, including contribution amounts, debts, and payment records.

As a result, the LAA was forced to suspend its online services to contain the breach.

The agency has not disclosed the full scope of the affected data or the number of individuals impacted but emphasized its ongoing efforts to address the incident.

“Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems so we can safely continue the vital work of the agency,” said Jane Harbottle, chief executive officer of the Legal Aid Agency.

“However, it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down.”

Harbottle stated that the agency, under the Ministry of Justice, has contingency plans to ensure continued legal support for those who need it.