UK Legal Aid Agency breach reaches records from 1978

Forensic review of the UK Legal Aid Agency's April 2025 breach found about 250,000 pre-2007 records, data back to 1978, and limited probation files.

The UK Legal Aid Agency says forensic review of an April 2025 intrusion—found on 23 April and confirmed as a broader theft on 16 May—shows stolen records reach 1978, although The Register, GBHackers, SecurityWeek and The Record describe 1978 as the earliest verified record rather than a wider set from that year. Most affected material concerns legal-aid applications, claims or payments from January 2007 through 16 May 2025, or cases live then, while about 250,000 records predate 2007 and are mostly from the 1990s and 2000s, according to an update dated 14 October 2026. Applicant data can include contact details, dates of birth, National Insurance or other national identity numbers, finances, criminal history and Crown Court charges, pleas, convictions and sentences; later reports also cite phone numbers, Client and Cost Management System entries, bank and property details, partially redacted card data, and names of judges and lawyers. Provider or practitioner material may include contracts, payment details, bank account names and numbers, sort codes, and portal usernames, emails or other credentials. Sources differ on probation data: The Register says attackers accessed HM Prison and Probation Service records for offenders supervised from 2010 to 2017, mostly in 2016 and 2017 and not victim records, while other outlets describe a limited set and The Record lists names, birth dates, nationalities and case references. Officials say there is no evidence of publication, with SecurityWeek adding no evidence of sale; DataBreaches.net says ShinyHunters claimed responsibility and was served with an injunction but the government called that claim unverified, Cyber Security News says the attackers and entry method are unidentified, and The Record says unnamed hackers claimed more than 2 million people's data and demanded payment while the UK maintains its no-payment policy. The Ministry of Justice is investing more than £200 million in modernizing and securing legal-aid systems and reports tighter access controls and legacy-system work.

• The Legal Aid Agency breach was found on 23 April 2025, with broader theft confirmed on 16 May 2025; an update dated 14 October 2026 identified the older files.
• About 250,000 stolen records predate 2007 and are mostly from the 1990s and 2000s; sources disagree on whether 1978 is one verified record or the start of the affected archive.
• Most compromised material covers legal-aid applications, claims or payments from January 2007 through 16 May 2025, or cases live in that period.
• Exposed fields can include contact details, dates of birth, National Insurance or other national identity numbers, finances, criminal history and Crown Court outcomes, plus provider contracts, bank details, sort codes and portal…
• Probation exposure is generally described as a limited set of 2010–2017 offender records; The Register specifies HM Prison and Probation Service files, mostly from 2016–2017 and not victim records.
• Officials report no evidence of publication, and SecurityWeek says none of sale. DataBreaches.net says an unverified ShinyHunters claim drew an injunction, while another outlet says the attackers and entry method remain unidentified.
• The Record says hackers claimed data on more than 2 million people and demanded payment; the UK maintains a no-payment policy.
• The Ministry of Justice is investing more than £200 million and reports tighter access controls and legacy-system work.