UK Legal Aid Agency hackers took records going back to 1978

The Legal Aid Agency, known as the LAA, published a new data update on GOV.UK on October 14, 2026. Minister Sarah Sackman also made a written statement to Parliament the same day.

Here's what the agency now says about the stolen data:

• Most of it: relates to applications, claims or payments made between January 2007 and May 16, 2025, or to cases that were live in that period.
• The new part: about 250,000 records are older than 2007.
• How old: the overwhelming majority come from the 1990s and 2000s, with only a "fractionally small number" from before 1990.
• The oldest: a record from 1978, the earliest verified so far.

The catch: a record is not a person. The Register notes the government warned that 250,000 is not a confirmed count of affected individuals, and that having old records doesn't mean everyone who used legal aid before 2007 was hit.

The LAA pays for legal help for people who can't afford a lawyer in England and Wales. BleepingComputer reports it has around 1,250 staff and works with about 2,000 providers, from solicitor firms to barristers and non-profits.

Here's how the incident unfolded:

• April 23, 2025 (a Wednesday): the agency identified a cyberattack on its online digital services.
• Early May 2025: it warned legal aid providers that their payment information might be compromised, BleepingComputer reports.
• May 16, 2025: it found the attack was far bigger than first thought, and that a criminal group had taken a large amount of personal data from applicants.
• July 2025: an update said the data went back to 2007, not 2010 as first reported, and could include information about applicants' partners.

The Register reports that the agency's online services were taken offline after the attack. Lawyers struggled to submit claims and manage cases for months, and the return to service in December came with delays and technical problems.

The agency says it has worked with the National Crime Agency, the National Cyber Security Centre and the Information Commission throughout.

The new GOV.UK page lists groups of people and the data that could be affected for each. The government stresses that not everyone in a group had all, or any, of it taken.

The oldest material comes from two places:

• Benefit checks, 1978 to 2012: for people who got civil legal aid because they received a qualifying benefit, such as Income Support. Details may include names, case reference numbers, dates of birth, National Insurance numbers and addresses.
• Very High Cost Cases, 1981 to 2004: payments on large criminal cases. Details include the person's name, case reference, their solicitor or advocate, and the amount and date of each payment.

The newer records can be more sensitive. For Crown Court trials between August 2010 and August 2017, or July 2018 and January 2025, the stolen data may include the offences charged, the plea, whether the person was convicted and the sentence.

A few other groups on the government's list:

• Civil Legal Help or mediation: solicitors' cost claims from January 2000 to May 2025, which may include full names, dates of birth, National Insurance numbers and postcodes.
• Debts to the LAA: debt management activity from April 2019 to December 2025, with names, case numbers and amounts owed.
• Crown Court contributions: for some cases from March 2010, details of the person's and their partner's income, property, bank accounts and other savings.

It goes beyond clients, too. Names of judges, defence and prosecution lawyers and court reporters from those Crown Court trials may be included, as well as provider bank details and LAA portal login names and emails.

In real life If you paid the LAA by card for a civil case between April 2019 and December 2025, your payment record may include a partially redacted card number. That's not enough to spend your money, but it's enough to make a fake "refund" call sound real.

This is the other surprise. The analysis found that some HM Prison and Probation Service data was inside the same stolen material.

What was taken: some names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed by probation services between 2010 and 2017.

By the numbers: more than 99% of that data covers people under supervision in 2016 and 2017.

The government says none of the probation data relates to victims of crime. It hasn't said how probation records ended up in systems reachable through the legal aid attack.

Think of it like a burglar who grabbed several boxes of mixed-up paperwork. You know the boxes are gone fast. Working out exactly which letters were inside takes much longer.

The Ministry of Justice says the attack hit several complex systems and a lot of data. Much of it was unstructured, fragmented or incomplete, which made it hard to analyze. Specialist teams have kept working on it since.

"Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency said, as quoted by The Register.

The Register points out that the update doesn't explain why records from the 1970s were still reachable in the first place.

The good news: the government says it has no indication that the stolen data has been published or shared. An injunction already bans anyone from sharing it, according to an earlier GOV.UK update.

What the government is spending: a Ministry of Justice spokesperson told BleepingComputer it had committed £20 million to stabilizing the LAA's systems before the attack. It is now investing more than £200 million in modernizing digital services, resilience and cyber security across legal aid.

According to The Register, the ministry says it has also tightened authentication and access controls, improved security monitoring, fixed vulnerabilities and started retiring or isolating higher-risk technology.

The big picture: BleepingComputer notes the UK announced a new cyber security strategy in January, backed by more than £210 million ($283 million), to strengthen defenses across government. We've covered similar national-scale breaches, like the Danish ID register breach earlier this month.

• Used legal aid in England or Wales? Your data may or may not be involved. The government's own answer to "Does this mean my data was compromised?" is no, not automatically.
• Expect smarter scams: a caller who knows your case number or old address isn't proof they're official. Hang up and call back on a number you looked up yourself.
• Check your passwords: use strong, unique passwords, especially if you ever used an LAA online portal.
• Need answers: the LAA customer services team is on 0300 200 20 20, 9am to 5pm, Monday to Friday. The National Cyber Security Centre has guidance for spotting scams.