UK Legal Aid Breach Exposed Records Dating Back to 1978

A forensic review has expanded the known scope of the April 2025 cyberattack on the UK Legal Aid Agency, an agency of the Ministry of Justice. Investigators found that attackers accessed records dating to 1978, including about 250,000 records created before 2007.

Most of the affected data relates to legal aid applications, claims and payments submitted between 2007 and 2025. The older records were mainly from the 1990s and 2000s, while only a small number dated from before 1990. “The earliest record currently verified dates from 1978,” the agency’s update said.

In May 2025, the agency disclosed that attackers had accessed and removed personal information belonging to people who applied for legal aid. It did not provide the full scope of the breach at that time.

Information linked to legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance numbers, postcodes, case reference numbers, telephone numbers and answers entered into the agency’s Client and Cost Management System.

The attackers also accessed information about legal aid practitioners, including contracts, work schedules, office locations, payment details and user account credentials. Other affected groups include judges, solicitors, advocates, parties in civil certificated proceedings and people who managed pay point locations.

Data relating to some probation service users was accessed as well. The information includes names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed by Probation Services between 2010 and 2017.

The investigation took time because the attack involved multiple systems and large amounts of unstructured, fragmented or incomplete data. Specialist technical and data teams analyzed the information to determine what the attackers accessed and removed.

The Legal Aid Agency has found no evidence that the stolen information has been published or sold.