UK Legal Aid Agency Hack Scope Widens After Forensic Review
Forensic review finds the UK Legal Aid Agency breach reached records from 1978 and some probation and practitioner data.
The UK Legal Aid Agency said an April 2025 breach reached records dating to 1978 after a lengthy forensic review. Most compromised material relates to applications, claims, and payments from 2007 through 2025, but about 250,000 records are older. Applicant data may include names, addresses, dates of birth, National Insurance numbers, phone numbers, and Client and Cost Management System entries. Attackers also took practitioner contracts, payment details, and user credentials, plus limited probation data for offenders managed from 2010 to 2017. The agency says it has no evidence the data was published or sold.
- Forensic review expanded the scope of the April 2025 Legal Aid Agency breach.
- About 250,000 compromised records predate 2007; the earliest verified is from 1978.
- Practitioner data included contracts, payment details, and user account credentials.
- Probation data covers a relatively small group managed between 2010 and 2017.
- The agency reports no evidence the stolen information was published or sold.
Full article391 words · extracted from securityweek.com · click to collapse
The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
In May last year, the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not share the full scope of the incident.
An incident update published this week reveals that most of the compromised records are related to applications, claims, and payments submitted between 2007 and 2025.
However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.
“The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978,” the update reads.
Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.
Advertisement. Scroll to continue reading.
The hackers also exfiltrated data pertaining to legal aid practitioners who interacted with LAA, including contracts, schedules, office locations, payment details, and user account credentials.
Other affected individuals include judges, solicitors, advocates, other parties in civil certificated proceedings, and individuals who managed pay point locations.
“Our improved cyber capabilities have also identified that data relating to probation service users was also accessed. The data exfiltrated by the attackers includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017,” LAA says.
According to the agency, its investigation into the incident took a long time because the attack involved multiple systems and significant volumes of information, most of which was unstructured, fragmented, or incomplete data.
“This has made analyzing the data complex. Therefore, since the incident, specialist technical and data teams have undertaken extensive work to understand what information the attackers accessed and exfiltrated,” the agency said.
LAA also underlined that it has no evidence that the stolen information has been released publicly or sold.
Related: CenterPoint Energy Data Breach Impacts 1 Million Texans
Related: iRhythm Data Breach Impacts at Least 360,000 People
Related: ASOS Confirms Cyberattack, Data Breach
Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register