The UK’s Legal Aid Agency (LAA) has uncovered a significant data breach affecting records dating back to 1978. This revelation follows a forensic review conducted after the breach was initially detected in April 2025.
Scope of the Data Breach
The agency, which operates under the UK Ministry of Justice, initially reported in May last year that hackers had accessed personal information from legal aid applicants. However, the full extent of the breach was not disclosed at the time. A recent update indicates that the majority of compromised records pertain to applications, claims, and payments from 2007 to 2025.
Forensic experts have confirmed that approximately 250,000 affected records predate 2007, with most originating from the 1990s and 2000s. The earliest verified record dates back to 1978, highlighting the extensive reach of the breach.
Types of Information Compromised
The stolen data includes sensitive information related to legal aid applicants and recipients, such as names, addresses, dates of birth, National Insurance Numbers, and case reference numbers. Additional details extracted by the attackers include data associated with the Client and Cost Management System (CCMS), phone numbers, and various other personal information.
Hackers also targeted data linked to legal aid practitioners interacting with the LAA, including contractual details, office locations, payment information, and user credentials. Other affected individuals comprise judges, solicitors, advocates, and those managing pay point locations.
Probation Service and Investigation Challenges
In a further revelation, the LAA identified that data related to probation service users was also compromised. This includes names, birth dates, nationalities, and case numbers for a limited number of individuals managed by Probation Services between 2010 and 2017.
The complexity of the attack, involving multiple systems and vast amounts of unstructured data, contributed to the lengthy investigation process. The LAA’s technical and data teams have been working diligently to determine precisely what data the attackers accessed and exfiltrated.
Despite these challenges, the agency has assured that there is currently no evidence to suggest the stolen information has been made public or sold.
This breach underscores the critical need for robust cybersecurity measures and highlights the ongoing risks faced by organizations handling large volumes of sensitive data.
