UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978

A cyberattack on Britain’s Legal Aid Agency (LAA) stole far older and broader records than the government previously disclosed, officials said Wednesday.

While initially claimed to have affected people who had used the service since 2010, the breach is now believed to include about 250,000 records predating 2007 and to include data on additional people who were being supervised by the probation service.

Justice Minister Sarah Sackman described the incident as “significant and complex” in a written statement to Parliament.

She explained the cyberattack “happened because criminals were able to exploit vulnerabilities in the LAA’s IT systems and gain access to systems containing personal information. They then copied and exfiltrated some data held by the department.”

The agency disclosed last May that hackers accessed data from people who applied for legal aid through its online service since 2010, potentially compromising data including criminal histories.

At the time, charities warned the data — believed to have been stolen by cyber extortionists — could contain sensitive information about women and girls who survived domestic abuse situations.

In an update published Wednesday, the Legal Aid Agency said continuing forensic analysis found more data was accessed than initially believed.

“The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and May 16, 2025, or to cases that were live during this period,” it said.

“However, we have now confirmed that approximately 250,000 records predate 2007. The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978.”

According to the forensic analysis, the stolen material also includes probation data covering names, dates of birth, nationalities and case reference numbers.

“It is important to put this updated information in context,” said the agency. “The presence of records predating 2007 does not mean that everyone who received or applied for legal aid, or otherwise interacted with the justice system before 2007, has been affected.”

It said the information exfiltrated varies between individual cases but can include full names, dates of birth, National Insurance numbers, ZIP codes, equality monitoring codes, case start and end dates, costs claimed, the amount of VAT claimed or paid as well as codes indicating the type of legal aid received.

Other categories include financial assessments of defendants and their partners, details of bank accounts and property, and in some cases partially redacted payment card details.

The names of judges, defense and prosecution lawyers, and court reporters involved in Crown Court trials over the same periods were also taken. So were details of opposing parties in some civil cases, according to the update.

The agency said the breach was hard to assess because much of the stolen data was “unstructured, fragmented, or incomplete.” It added that earlier public statements reflected the best information available at the time.

Sackman told the House of Commons that the department has no indication the stolen data has been published or shared — a shift in view from May 2025, when a ministry spokesperson told Recorded Future News that its publication was a question of “when, not if.”

The hackers had claimed to hold data on more than 2 million people and threatened to release it unless they received payment. The British government has a longstanding policy of refusing to pay extortion demands.

Sackman said the ministry has since strengthened authentication and access controls, improved security monitoring and begun retiring or isolating higher-risk legacy systems. It continues to work with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner's Office, the U.K.’s data protection regulator.