Hackers Steal UK Legal Aid Records Dating Back to 1978 in Major Cyberattack

The UK’s Legal Aid Agency (LAA) now says the 2025 data breach exposed far older data than first reported. About 250,000 stolen records predate 2007, and the earliest verified record is from 1978.

UK legal aid cyberattack

The LAA identified a cyber-attack on its online digital services on Wednesday 23 April 2025. It secured its systems and warned legal aid providers that financial information may have been compromised.

It has worked with the National Crime Agency, the National Cyber Security Centre (NCSC) and the Information Commission.[gov]

On 16 May 2025, investigators concluded the attack was broader than first understood. The criminal group had accessed and exfiltrated a significant amount of personal data on applicants and providers.

According to an update published by the UK Government on 14 October 2026, the agency said continued forensic analysis had refined the date range and the types of data affected.

Most of the data covers applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period. The roughly 250,000 older records are mostly from the 1990s and 2000s, and only a fractionally small number predate 1990.[gov]

Investigators also found probation data from HM Prison and Probation Service (HMPPS) in the exfiltrated material. It covers names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed between 2010 and 2017.

More than 99% of it relates to 2016–2017. None of it concerns victims of crime.

Provider data may include contracts, office locations, payment details, bank account names, account numbers and sort codes. It may also include LAA Online Portal user names and email addresses, plus correspondence records from the CCMS and MAAT systems.[gov]

Judges, solicitors, advocates and court reporters tied to Crown Court trials were also affected. So were opponents in civil cases and people who managed pay point locations.[gov]

The LAA stresses that having a record from a given period does not mean a person’s data was stolen. It also says it has no indication that the stolen data has been published or shared.

The agency says the affected systems held large volumes of unstructured, fragmented or incomplete data, which made analysis slow. It credits improved data-identification capability for the more complete picture.

The Ministry of Justice and LAA say they have strengthened authentication and access controls and improved security monitoring. They have also addressed vulnerabilities, retired or isolated higher-risk technology, and begun longer-term modernisation of legacy systems.[gov]

The LAA advises people who may be affected to watch for suspicious messages, emails and calls, be cautious about unexpected requests for personal or financial information, verify independently who is asking for sensitive details, and use strong passwords and avoid reusing them across accounts.

Affected people can call the LAA Customer Services Team on 0300 200 20 20, 9am to 5pm, Monday to Friday.