Threat intel
Legal Aid Agency breach reaches records from 1978
The UK Legal Aid Agency now says data stolen in April 2025 includes 250,000 records older than 2007. What was taken, and what providers and data owners should do.
The UK Legal Aid Agency (LAA), the Ministry of Justice (MoJ) agency that funds legal aid in England and Wales, published a data update on October 14, 2026 about the cyber attack it found in April 2025. Further forensic work shows the attackers took far older data than first reported. Roughly 250,000 of the stolen records predate 2007, most from the 1990s and 2000s, and the earliest record verified so far is from 1978, which stretches the stolen data across 47 years. Justice Minister Sarah Sackman set out the update in a written statement to Parliament the same day.
Most of the stolen data still covers applications, claims and payments submitted between January 2007 and May 16, 2025, or cases that were live in that period. The oldest material is different in kind: legal aid benefit status assessments from 1978 to 2012, and payments under the Very High Cost Cases (VHCC) scheme, which funds the longest and most expensive criminal trials, from 1981 to 2004. Anyone who applied for legal aid, worked a legal aid case or was supervised by probation in 2016 or 2017 may appear in this data.
How the exposure happened, as far as is known
The LAA became aware of the attack on April 23, 2025. The target was its online digital services, which legal aid providers use to log work and get paid. At first the agency warned providers that their payment details might be affected. On May 16 it found the attack was much wider and that a large amount of applicant data had been taken, and it took the systems offline that day.
The scope has been revised twice since. The May 2025 notice covered people who applied online since 2010. On July 31, 2025 the LAA moved that back to 2007 and added that information about applicants' partners might be included. The October 2026 update now reaches 1978. The MoJ says the data was spread across several complex systems and much of it was unstructured, fragmented or incomplete, and that improved data identification produced the fuller picture.
That also explains the caveat the MoJ attaches to every figure. The 250,000 pre-2007 records are not a confirmed count of affected people, and finding records from before 2007 does not mean everyone who applied for or received legal aid before then was affected. The update does not name the attackers, does not say how they got in and does not identify a vulnerability. It also does not say why records from the 1970s were still reachable from systems an attacker could get into in 2025.
What the attackers took
The October update groups the data by who it describes. What is present varies from record to record.
- Applicants and recipients: names, dates of birth, National Insurance numbers, postcodes, case start and end dates, costs claimed, financial assessment answers about defendants and their partners, some correspondence and, in some cases, partially redacted payment card details. The 2025 notices also listed contact details, employment status and criminal history.
- Legal aid providers: contracts, office locations, bank account names, account numbers and sort codes, contact details, and LAA Online Portal user names and email addresses.
- Others connected with cases: names of judges, solicitors, advocates and court reporters, and opposing parties in some civil cases.
- Probation data from HM Prison and Probation Service (HMPPS): names, dates of birth, nationalities and case reference numbers for a relatively small number of people supervised between 2010 and 2017, over 99% of them in 2016 and 2017. The MoJ says none of it relates to victims of crime.
The attackers threatened to release the data unless paid. Reports describe their claim differently: The Record says data on more than 2 million people, while May 2025 coverage put it at 2.1 million pieces of data. The MoJ has never verified either figure. The October update says the MoJ has no indication the stolen data has been published or shared. A court injunction prohibits sharing it.
What affected individuals should do
The official advice is short, and the case data makes it more important than usual. Treat unexpected calls, emails and texts that mention a legal aid case, a court date or a payment as suspect, even when the caller knows real details. Verify anyone asking for personal or financial information through a number or address you find yourself. Use a unique password for every account. If you changed passwords after the 2025 notice, there is no new instruction to change them again, but any password reused from an old legal aid account should go. The National Cyber Security Centre (NCSC) has a guide on what to do after a data breach.
What legal aid providers should do
Portal user names and email addresses are confirmed as stolen, and the MoJ asked people to change potentially exposed passwords in May 2025. If anyone at the firm reused that password on Microsoft 365, the case management system or banking, change those passwords now and turn on multi-factor authentication (MFA) where it is still missing. Remove LAA access for staff who have left.
The stolen material lets a scammer write to a firm as the LAA or as a client and quote real contract details, bank details and case information. Brief fee earners and accounts staff that a request to change bank details or resubmit a claim is checked by phone on a number already on file. The LAA's own guidance tells providers to watch their bank accounts for unusual activity, since account numbers and sort codes were exposed.
Long-retained data is the lesson for everyone else
The oldest stolen records predate any current online system by decades. Records kept long after their purpose has ended give an attacker something to take and give the owner nothing back. Most organisations have the same problem in a smaller form.
- Find the legacy stores. Search file shares, old database instances, migration exports and backup sets for personal data by pattern, such as National Insurance number or account number formats, rather than trusting an inventory written years ago. Data that was meant to stay in an archive often ends up in a reporting copy or a migration staging table.
- Check retention against the schedule. For each store, note the newest and oldest record and the retention period that applies. Delete what has passed it. If records must be kept, move them offline or to an isolated system that the internet-facing services cannot reach.
- Test reachability. From the network segment that hosts your public portals, check which legacy databases and shares answer. The MoJ's own fixes after this incident include retiring or isolating higher-risk technology.
- Clean up portal credentials. Require MFA on every external portal, remove dormant accounts on a schedule, and block passwords known to have leaked.
Our compliance and audit readiness work maps where personal data actually lives against your retention schedule, and our safeguarding and hardening team isolates or retires the legacy systems that should no longer be reachable. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: GOV.UK LAA data update, October 2026, GOV.UK LAA data breach notice, GOV.UK LAA incident FAQs, BleepingComputer, The Record, The Register, Cyberpress, GBHackers, Shattered, Computer Weekly.