UK Legal Aid Agency data breach extends back to 1978

The UK’s Legal Aid Agency (LAA) has revealed that a cyberattack discovered in April 2025 compromised a significantly larger volume of data than initially estimated. Forensic reviews confirmed that approximately 250,000 records predate 2007, with the earliest verified record dating back to 1978. The majority of the compromised data originates from the 1990s and 2000s.

The exfiltrated information includes names, addresses, dates of birth, National Insurance Numbers, and case reference numbers for legal aid applicants and recipients. It also includes data pertaining to legal aid practitioners, such as contracts, payment details, and user account credentials. Additionally, the agency confirmed that data relating to a small number of offenders managed by Probation Services between 2010 and 2017 was also accessed, though there is no evidence that information regarding crime victims was included.

Minister of State for Courts and Legal Services Sarah Sackman stated that the Ministry of Justice is working to identify specific individuals whose data was stolen. While the breach is extensive, the agency noted that the presence of older records does not mean every individual who interacted with the justice system before 2007 has been affected.