UK Legal Aid Agency hack worse than disclosed, with stolen records dating back to 1978

TLDR

• The Legal Aid Agency said about 250,000 records stolen in its 2025 cyber-attack predate 2007, the earliest from 1978.¹²
• The stolen material also includes probation data, a revised, larger scope for the incident.¹²
• The agency has no indication the data has been published or shared.¹²

The Legal Aid Agency said it identified a cyber-attack on its online digital services on 23 April 2025 and established on 16 May 2025 that the attack was more extensive than first understood, with a criminal group accessing and exfiltrating a significant amount of personal data.¹ Its October 2026 update says the vast majority of the data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or to cases live in that period, but that about 250,000 records predate 2007, mostly from the 1990s and 2000s.¹

The Record reports that the breach was initially said to affect people who had used the service since 2010, and that the newly disclosed material also includes data on people supervised by the probation service.² The agency's update says the information taken varies between individuals. Depending on the category, it can include full names, dates of birth, National Insurance numbers, postcodes, case dates and costs claimed; The Record adds that other categories include financial assessments of defendants and their partners, bank and property details, in some cases partially redacted payment card details, and the names of judges, lawyers and court reporters in Crown Court trials.¹² The agency stresses that having pre-2007 records in the dataset does not mean everyone who dealt with the justice system before then was affected, and that none of the probation data relates to victims of crime.¹

Justice Minister Sarah Sackman described the incident in a written statement to Parliament as "significant and complex" and said criminals exploited vulnerabilities in the agency's IT systems to copy and exfiltrate data.² She said the department has since strengthened authentication and access controls, improved security monitoring and begun retiring or isolating higher-risk legacy systems, and continues to work with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner's Office.² The agency said assessing the breach was difficult because much of the stolen data was unstructured, fragmented or incomplete.²

Why it matters: this is a revised, larger scope for an incident first disclosed in 2025, covering legal aid, criminal-case and probation records going back decades. The agency has published tables of the groups and data types potentially affected, and stresses that not everyone in those groups had their data taken.¹