UK Legal Aid Agency Hackers Stole Records Dating Back to 1978
Hackers breached the UK's Legal Aid Agency, stealing records dating back to 1978, with the incident impacting approximately 250,000 records and including sensitive data from HM Prison and Probation Service.
The UK's Legal Aid Agency (LAA) has admitted that a cyberattack last year resulted in the theft of records stretching back nearly five decades, significantly expanding the known scope of the breach. Initially detected in April 2025, the incident, which saw hackers access and download sensitive personal information, is now understood to have compromised around 250,000 records. Crucially, many of these newly identified records date from before 2007, with some extending as far back as 1978, a stark contrast to the agency's initial assessment that the stolen data primarily covered legal aid applications from 2007 onwards.
While the majority of the historical records originate from the 1990s and 2000s, the discovery of data from the late 1970s raises significant questions about the security of long-term data storage within government systems. The Ministry of Justice (MoJ) also revealed that the attackers gained access to information pertaining to the HM Prison and Probation Service (HMPPS). This included personal details such as names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017.
The MoJ emphasized that the HMPPS data affects a relatively small number of offenders, with over 99 percent of this specific compromised data relating to individuals under supervision in 2016 and 2017. Importantly, the government stated that none of the stolen probation information pertains to victims of crime. This latest disclosure comes more than 18 months after the LAA first became aware of the intrusion on April 23, 2025, with the full extent of the compromise only being established by May 16 of the same year.
The aftermath of the breach saw the LAA's online services taken offline for an extended period, causing considerable disruption for legal professionals who rely on these systems for case management and claims submission. The agency's return to service in December was marred by ongoing technical issues and delays, further compounding the difficulties faced by legal aid providers.
The compromised information, which varies by individual, could encompass a wide range of sensitive data including names, addresses, dates of birth, National Insurance numbers, financial details, and specifics about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences. The older material includes records related to legal aid benefit assessments from 1978 to 2012 and payments from the Very High Cost Cases scheme between 1981 and 2004.
Officials cautioned that the presence of historical records does not necessarily mean all individuals who applied for legal aid before 2007 had their data stolen, nor does the 250,000 figure represent a definitive count of affected individuals. The MoJ attributed the delay in fully understanding the breach's scope to the attackers' exfiltration of data spread across multiple complex systems, much of which was unstructured, fragmented, or incomplete.
"Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency stated. While the government reports no indication that the stolen information has been published or shared, this offers little solace to those whose personal details may now be in the hands of cybercriminals.
In response to the incident, the MoJ has implemented enhanced security measures, including tightened authentication and access controls, improved security monitoring, and remediation of identified vulnerabilities. Efforts are also underway to modernize the agency's legacy systems, though the question of why such extensive historical data remained accessible remains a significant concern.
The UK Legal Aid Agency (LAA) has provided an updated investigation into its 2025 cyberattack, revealing that approximately 250,000 records predating 2007 were accessed, significantly expanding the known scope of the breach. This latest update clarifies that most of the older data originates from the 1990s and 2000s, with very few records dating from before 1990, and confirms that the breach affected legal aid applicants, providers, and some probation service users. The agency also detailed that the compromised information could include names, addresses, dates of birth, National Insurance numbers, financial assessments, and sensitive court records, with some probation data also exposed.