UK legal aid hack: 250,000 of the stolen records date from before 2007

1978. That is the year of the oldest record found so far in the data stolen from the Legal Aid Agency (LAA), the agency of the UK Ministry of Justice that funds legal aid in England and Wales. Forty-eight years later, that document is part of the loot from a cyberattack.

On October 14, the agency published an update to its analysis. Roughly 250,000 stolen records predate 2007, the vast majority from the 1990s and 2000s, and a few from before 1990. The investigation also reveals that data from the probation service (HMPPS) was part of the haul.

An attack 18 months old

The intrusion was detected on April 23, 2025. In early May, the agency first mentioned payment information for the lawyers and firms that work for it. On May 16, 2025, it acknowledged a far more serious theft, affecting people who had applied for legal aid. The agency then referred to applications submitted since 2010.

The October assessment is broader. According to the agency, most of the data concerns applications, invoices or payments between January 2007 and May 16, 2025. But some files go back further: recipients of civil aid or mediation since 2000, and data tied to social benefits from 1978 to 2012, including name, date of birth, national insurance number and address.

What the files contain

The categories detailed by the agency are sensitive: for some criminal cases tried in the Crown Court between 2010 and 2025, name, address, date of birth, alleged offenses, plea, verdict and sentence. Also included are the bank details of legal providers, the names of judges and lawyers, and sometimes those of opposing parties in civil disputes.

On the probation side, the data covers names, dates of birth, nationalities and case numbers for a number of people the agency describes as relatively small, supervised between 2010 and 2017, with more than 99% in 2016 and 2017. The agency says none of this data concerns victims of crime.

Relatively good news: “We have no indication that the stolen data has been published or shared,” writes the LAA. For now, nothing suggests the data has been published or shared. Neither the agency nor BleepingComputer mentions any claim of responsibility. A Ministry of Justice spokesperson, quoted by BleepingComputer, notes that £20 million had been committed to modernize the agency's systems before the attack. More than £200 million is now devoted to modernization and cybersecurity for legal aid.

The lesson: what you don't keep can't leak

The 1978 data posed no problem as long as it sat idle on a server. During the intrusion, it was carried off along with everything else. The GDPR, like its UK version, requires organizations to keep personal data only as long as necessary. For a French organization, the reflex is the same: check what old databases and archives still connected to the network contain, and delete or isolate whatever is no longer used.

For those affected, the agency advises being wary of unexpected calls, emails and messages, verifying the identity of anyone asking for sensitive information, and using unique passwords. It stresses that having applied for legal aid does not automatically mean one's data has leaked.

The agency says it has informed the UK data protection authority. Its analysis is continuing: 1978 may not be the last surprise.