UK Legal Aid Agency says hackers stole records dating back to 1978

The UK's Legal Aid Agency (LAA) has disclosed that data stolen in last year's cyberattack reaches back almost five decades, according to BleepingComputer. In an update published this week, the agency said follow-up analysis found that roughly 250,000 of the stolen records predate 2007, and that the earliest verified record dates from 1978. The finding significantly widens the known scope of a breach that exposed sensitive information, including criminal history, about people who applied for legal aid in England and Wales.

What happened

BleepingComputer reports that attackers breached the LAA's IT systems in April 2025. The agency, an executive agency of the Ministry of Justice that also manages the Public Defender Service, disclosed the attack in early May 2025 and initially warned that legal aid provider payment information might have been compromised. About two weeks later, it confirmed a more serious breach involving data on applicants and recipients from 2010 onward.

The latest update states that most of the stolen records relate to applications, claims or payments submitted between January 2007 and May 16, 2025, or to cases that were live during that period. Of the roughly 250,000 older records, most are from the 1990s and 2000s, with what the LAA called a "fractionally small number" from before 1990. The agency stressed that the 1978 record does not mean everyone who applied for or interacted with legal aid before 2007 was affected.

The article does not name a threat group responsible for the LAA intrusion.

Who is affected

According to BleepingComputer, information about applicants and recipients includes contact details, dates of birth, national ID numbers, criminal history, employment status, contribution amounts, debts and payments. For legal aid providers, the stolen data includes contracts, office locations, financial information, contact details and LAA Online Portal account names and email addresses.

The LAA employs about 1,250 staff and works with around 2,000 providers, including barristers, solicitor firms and non-profit organisations.

Response

A Ministry of Justice spokesperson said there is currently no evidence that any personal data believed to have been exfiltrated has been published. The ministry said it had committed £20 million to upgrading the LAA's digital systems before the attack and is now investing more than £200 million in modernising digital services, resilience and cyber security.

BleepingComputer noted that the LAA breach was followed by attacks on UK retailers including the Co-op, Harrods and Marks & Spencer, which were claimed by the DragonForce ransomware operation, and that the National Cyber Security Centre has urged UK organisations to strengthen their defences.

What to do

People who applied for or received legal aid, especially those with older cases, should follow the LAA's updates on GOV.UK and be cautious of unsolicited calls, emails or letters that reference legal matters or personal details. Legal aid providers should ensure portal credentials have been changed and watch for targeted phishing that uses contract or payment information.