The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
In May last year, the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not share the full scope of the incident.
An incident update published this week reveals that most of the compromised records are related to applications, claims, and payments submitted between 2007 and 2025.
However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.
“The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978,” the update reads.
Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.
The hackers also exfiltrated data pertaining to legal aid practitioners who interacted with LAA, including contracts, schedules, office locations, payment details, and user account credentials.
Other affected individuals include judges, solicitors, advocates, other parties in civil certificated proceedings, and individuals who managed pay point locations.
“Our improved cyber capabilities have also identified that data relating to probation service users was also accessed. The data exfiltrated by the attackers includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017,” LAA says.
According to the agency, its investigation into the incident took a long time because the attack involved multiple systems and significant volumes of information, most of which was unstructured, fragmented, or incomplete data.
“This has made analyzing the data complex. Therefore, since the incident, specialist technical and data teams have undertaken extensive work to understand what information the attackers accessed and exfiltrated,” the agency said.
LAA also underlined that it has no evidence that the stolen information has been released publicly or sold.
Related: CenterPoint Energy Data Breach Impacts 1 Million Texans
Related: iRhythm Data Breach Impacts at Least 360,000 People
Related: ASOS Confirms Cyberattack, Data Breach
Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
