UK Legal Aid Agency Data Breach Exposes Personal Records Dating Back to 1978

The UK Legal Aid Agency (LAA) has confirmed that its 2025 cyberattack stole personal records dating back to 1978. An updated investigation found approximately 250,000 records from before 2007, widening the known scope of a breach that affected legal aid applicants, providers and some probation service users.

In its October 14, 2026 update, the agency said most affected data concerned applications, claims, payments or cases active between January 2007 and May 16, 2025. Most older records came from the 1990s and 2000s, with very few dating from before 1990.

The LAA first detected the attack on April 23, 2025, and warned legal aid providers that information, including financial details, might have been compromised. On May 16, investigators established that attackers had accessed and stolen a significant amount of personal data, making the incident more serious than initially understood.

Technical teams have since examined data spread across several complex systems. Much of the material was unstructured, split into separate parts or left incomplete, making it hard to determine exactly what attackers took. The latest findings reflect further analysis of the original incident rather than a newly disclosed attack.

Personal, Financial and Court Records Affected

Depending on the person and case, stolen information may include names, addresses, dates of birth, National Insurance numbers, financial assessments and legal case details. Some Crown Court records contain charges, pleas, convictions and sentences. Other records may include information about partners, family members and parties involved in civil proceedings.

The oldest category includes benefit checks linked to civil legal aid between 1978 and 2012. Provider information may include bank account names, account numbers, sort codes, payment records and online portal user details. However, the agency stressed that neither every person nor every listed data field was necessarily affected.

The breach also highlights the sensitivity of court information, an issue seen in the separate NSW Online Registry data breach, where approximately 9,000 court documents were downloaded without permission. That incident is not linked to the LAA attack.

Investigators also found probation data belonging to a relatively small number of people supervised between 2010 and 2017. More than 99% related to supervision during 2016 and 2017. Exposed fields included some names, birth dates, nationalities and case references. The agency said this probation data did not concern crime victims.

The LAA says it has no indication that stolen information has been published or shared. Its update does not identify the attackers or explain their entry method. Security work includes stronger authentication, tighter access controls, better monitoring, vulnerability fixes, and isolating or retiring higher-risk technology. Such measures also involve patch management practices

People who believe they may be affected should watch for unexpected messages and independently verify requests for personal or financial information.

The NCSC’s data breach guidance recommends contacting organizations through official channels, avoiding contact details supplied in suspicious messages, replacing reused passwords, and checking accounts for unusual activity following a breach.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.