The Department’s estimate of £850 million for the total costs related to the February 2022 data breach does not include legal costs, which the Department estimates will be at least £2.5 million, or compensation claims from people affected. In July 2025, following the public disclosure of the February 2022 data breach, several law firms reported that they were assisting affected individuals in seeking compensation from the government.66 We asked the Department if it set aside any contingent liability for compensation. It told us this would be a “live issue” with the Comptroller and Auditor General, between the Committee’s session and the publication of the Department’s accounts for 2024–25. The Department said the government currently planned to defend compensation claims robustly in the courts, which would factor into its judgments about financial provision.67 60 C&AG’s Report, para 32, Q 47 61 C&AG’s Report, para 24 62 C&AG’s Report, para 33 63 Qq 47, 49 64 Q 56 65 Qq 49–50 66 C&AG’s Report, paras 31, 37, Figure 4 67 Q 58 16