UK Legal Aid Breach Wider Than Thought: Stolen Records Go Back to 1978

The UK government has revealed that the April 2025 cyber attack on its Legal Aid Agency (LAA) was far more extensive than first believed. The agency says around 250,000 stolen records date from before 2007, including one from 1978. It had initially said the stolen data covered legal aid applications, claims and payments from 2007 onwards. Most of the newly identified records come from the 1990s and 2000s, with only a "fractionally small number" from before 1990.

The Ministry of Justice has also found that attackers accessed data from HM Prison and Probation Service. This includes names, dates of birth, nationalities and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the number of people affected is relatively small, with more than 99 percent of the data relating to 2016 and 2017, and that no victim information was taken.

The agency detected the intrusion on 23 April 2025 and established its scale on 16 May. Its online services were then taken offline, leaving lawyers struggling to submit claims and manage cases. The disruption lasted months, and the return to service in December brought further delays and technical problems. The new findings come from continued forensic work, and they raise questions about how much historical personal information was still held in government systems when the attack happened.