UK Legal Aid Agency Breach Exposes Decades of Personal Records

One of the records taken in the April 2025 intrusion dates back to 1978, the Ministry of Justice has admitted — a single datapoint that has forced a reassessment of how much decades‑old personal information remained reachable on government systems.

Scope and timeline of the compromise

The Legal Aid Agency (LAA) first detected unauthorised access on 23 April 2025 and officials did not establish the scale of the compromise until 16 May 2025. The agency now says around 250,000 records were stolen in the attack and that those records include material predating 2007, contrary to earlier estimates. Most of the newly identified material dates from the 1990s and 2000s; only a “fractionally small number” of records originate before 1990.

What types of records were taken

The compromised information varies by individual but, according to the government, could include names, addresses, dates of birth, National Insurance numbers, financial details and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions and sentences. Among the older material are records relating to legal aid benefit assessments dated from 1978 to 2012 and payments made under the Very High Cost Cases scheme between 1981 and 2004.

HM Prison and Probation Service data was also accessed

Further forensic work revealed that the attackers accessed information from HM Prison and Probation Service (HMPPS). The data included names, dates of birth, nationalities and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the probation records concern a relatively small number of offenders and that more than 99 percent of the affected probation data relate to people under supervision in 2016 and 2017. Officials stressed that none of the stolen probation information relates to victims of crime.

Operational impact: systems taken offline and a troubled return

After the breach was identified, the government took the LAA’s online services offline, a disruption that left lawyers unable to access systems used to submit claims and manage cases. The disruption “dragged on for months,” and the agency’s return to service in December was described as troubled, with legal aid providers continuing to battle delays and technical problems as the service came back into use.

Why the scale grew with further forensic work

The Ministry of Justice explains the widening extent of the breach by pointing to the complexity of the data environment the attackers accessed. Officials say the criminals stole information spread across several complex systems, much of it “unstructured, fragmented or incomplete.” As forensic capabilities improved, the agency said it was able to identify additional compromised data: “Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised,” the agency said.

What this means for legal aid providers, HMPPS and the public

• Legal aid providers: They faced prolonged IT disruption after the attack — months offline and a problematic December return to service that resulted in delays and ongoing technical problems. Practitioners will have to contend with case management backlogs and uncertain data exposure for clients whose files were handled through the LAA systems.
• HM Prison and Probation Service and supervised offenders: A relatively small subset of probation records spanning 2010–2017 was exposed, with more than 99 percent of those records tied to supervision in 2016–2017. HMPPS will be focused on identifying affected individuals and assuring that none of the stolen records pertain to victims, as the government has stated.
• The public and individuals named in records: The MoJ cautioned that the presence of historical records in the breached systems does not mean everyone who applied for legal aid before 2007 had their information stolen, and it said the 250,000 figure does not represent a confirmed count of affected individuals. The department also says it has no indication the stolen information has been published or shared.

Remediation steps and remaining questions

Since the attack, the government reports it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher‑risk technology. Work to modernise legacy systems is also under way. But the update does not explain why records stretching back to the late 1970s remained accessible to the attackers, nor does it convert the headline number of records into a confirmed tally of people affected. The government’s statement that there is no indication the data has been published or shared offers some reassurance, but it stops short of certainty for anyone whose personal details may now be in criminal hands.

The intrusion is now recorded as a case where ageing, fragmented systems and delayed visibility combined to magnify harm: as forensic capability grew, so too did the list of compromised records. The challenge the MoJ has set itself — retiring riskier technology and modernising legacy systems — is specific and concrete. Whether those steps will close the gap that allowed nearly five decades of records, however few in number, to be exposed remains the central question.

Original reporting: The Register — Legal Aid Agency hackers made off with records dating back to 1978