UK Legal Aid Agency says hackers stole records dating back to 1978
The Legal Aid Agency says forensic analysis found stolen records dating back to 1978, while warning that not everyone in the affected groups was exposed.
The UK’s Legal Aid Agency says attackers who breached its systems in April 2025 stole records dating back to 1978, revising the known date range of the incident after months of forensic analysis. The agency says approximately 250,000 records predate 2007, although it stresses that the presence of old records does not mean every person who used legal aid before that date was affected.1
What the Legal Aid Agency has confirmed
The Legal Aid Agency is an executive agency of the Ministry of Justice responsible for administering legal aid in England and Wales. According to its latest update, the majority of the affected data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or to cases that were live during that period.1
The agency has now confirmed that around 250,000 records predate 2007. Most of those records come from the 1990s and 2000s, but a small fraction reaches back before 1990. The earliest record currently verified dates from 1978.1
The possible data varies depending on the person and the system involved. The government’s tables include examples such as names, dates of birth, National Insurance numbers, postcodes, case references, payment information and details entered into civil legal-aid applications. The update repeatedly warns that the tables describe data that could be affected, not a complete list of information taken from every individual.
The same incident also exposed some probation-related information held by HM Prison and Probation Service. The Legal Aid Agency says none of that data relates to victims of crime. It also says there is currently no indication that the stolen data has been published or shared.1
A breach that grew more serious over time
The Legal Aid Agency first identified the cyber-attack on 23 April 2025 and initially warned providers that some financial information might have been compromised. By 16 May 2025, further investigation had established that attackers had accessed and exfiltrated a significant amount of personal data.1
BleepingComputer reports that the stolen material can include information connected to legal-aid applicants, recipients and providers, including contact details, dates of birth, criminal-history information, employment status, debts, payments, provider contracts and portal credentials.2 The government’s own update is more cautious about individual exposure: it says the nature and amount of data affected varies considerably, and that not every person in an affected group necessarily had all — or any — of the listed information exfiltrated.
The agency says it is continuing to work with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office. It has also said that it is strengthening authentication and access controls, improving monitoring, addressing vulnerabilities and modernising higher-risk legacy technology.1
For people concerned about the incident, the agency’s official update directs them to its dedicated information and enquiry channels. The government says the incident page will be kept under review as the investigation develops.
Our opinion
The most important detail here is not simply that the records are old; it is that the confirmed scope has expanded again after a long investigation. Readers should avoid assuming that a legal-aid application from a particular year was automatically exposed, because the government explicitly says the affected data differs from person to person. The agency’s statement that it has no indication of publication or sharing is reassuring, but it does not remove the need for affected people to follow the official guidance and remain alert to targeted fraud or impersonation attempts.