Hackers Steal UK Legal Aid Records Dating Back to 1978 in Major Cyberattack
The UK Legal Aid Agency says its 2025 breach exposed records dating to 1978, including about 250,000 older files.
The UK Legal Aid Agency said forensic work shows its April 2025 cyberattack exposed far older material than first reported, including about 250,000 records from before 2007 and a verified record from 1978. Most affected data concerns legal-aid applications, claims, or payments from January 2007 through May 16, 2025. Exfiltrated provider information may include contracts, payment details, bank account names and numbers, sort codes, and portal usernames and emails. A small set of HM Prison and Probation Service records from 2010 to 2017 was also taken; the agency says it has no indication the data has been published.
- The attack was found April 23, 2025, with broader theft confirmed May 16, 2025.
- Most records span January 2007 to May 16, 2025; about 250,000 are older.
- Provider data may include bank details, sort codes, and portal email addresses.
- Limited probation data from 2010 to 2017 was also included.
- The agency says it has no sign the stolen data was published.
Full article471 words · extracted from gbhackers.com · click to collapse
The UK’s Legal Aid Agency (LAA) now says the 2025 data breach exposed far older data than first reported. About 250,000 stolen records predate 2007, and the earliest verified record is from 1978.
UK legal aid cyberattack
The LAA identified a cyber-attack on its online digital services on Wednesday 23 April 2025. It secured its systems and warned legal aid providers that financial information may have been compromised.
It has worked with the National Crime Agency, the National Cyber Security Centre (NCSC) and the Information Commission.[gov]
On 16 May 2025, investigators concluded the attack was broader than first understood. The criminal group had accessed and exfiltrated a significant amount of personal data on applicants and providers.
According to an update published by the UK Government on 14 October 2026, the agency said continued forensic analysis had refined the date range and the types of data affected.
Most of the data covers applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period. The roughly 250,000 older records are mostly from the 1990s and 2000s, and only a fractionally small number predate 1990.[gov]
Investigators also found probation data from HM Prison and Probation Service (HMPPS) in the exfiltrated material. It covers names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed between 2010 and 2017.
More than 99% of it relates to 2016–2017. None of it concerns victims of crime.
Provider data may include contracts, office locations, payment details, bank account names, account numbers and sort codes. It may also include LAA Online Portal user names and email addresses, plus correspondence records from the CCMS and MAAT systems.[gov]
Judges, solicitors, advocates and court reporters tied to Crown Court trials were also affected. So were opponents in civil cases and people who managed pay point locations.[gov]
The LAA stresses that having a record from a given period does not mean a person’s data was stolen. It also says it has no indication that the stolen data has been published or shared.
The agency says the affected systems held large volumes of unstructured, fragmented or incomplete data, which made analysis slow. It credits improved data-identification capability for the more complete picture.
The Ministry of Justice and LAA say they have strengthened authentication and access controls and improved security monitoring. They have also addressed vulnerabilities, retired or isolated higher-risk technology, and begun longer-term modernisation of legacy systems.[gov]
The LAA advises people who may be affected to watch for suspicious messages, emails and calls, be cautious about unexpected requests for personal or financial information, verify independently who is asking for sensitive details, and use strong passwords and avoid reusing them across accounts.
Affected people can call the LAA Customer Services Team on 0300 200 20 20, 9am to 5pm, Monday to Friday.