Legal Aid Agency: stolen records go back to 1978, probation too
The UK Legal Aid Agency breach is wider than thought: 250,000 records predate 2007, the oldest from 1978, and probation data was also exfiltrated.
The Legal Aid Agency (LAA), the UK Ministry of Justice agency that runs legal aid in England and Wales, published an update on 14 October 2026 about the cyberattack it suffered in April 2025. New forensic analysis shows that the stolen data is older and broader than previously disclosed: around 250,000 records predate 2007, and the oldest verified record dates from 1978. Probation service data was also among the exfiltrated information.
The case matters to anyone running systems with a long history: data kept longer than necessary and scattered across poorly structured stores widens the damage and slows down incident assessment.
What happened
According to The Register, the intrusion was detected on 23 April 2025, but its scale was only established on 16 May. In early May 2025 the agency had mentioned possible payment data of legal aid providers; two weeks later it admitted that applicant data from 2010 onwards had been stolen. The LAA’s online services were taken offline and, as The Register reports, the return to service in December brought delays and technical problems for lawyers and firms.
In this week’s update, reported by all sources, the agency writes that the vast majority of the data concerns applications, claims and payments between January 2007 and 16 May 2025, but that around 250,000 records are older: mostly from the 1990s and 2000s, with a “fractionally small” number from before 1990. The Register adds that the older material includes legal aid benefit assessments from 1978 to 2012 and payments under the Very High Cost Cases scheme from 1981 to 2004.
The agency points out that 250,000 is not a confirmed number of affected people, and that the presence of pre-2007 records does not mean everyone who applied for legal aid before then is affected.
What data was stolen
The data varies from person to person. Cross-checking the sources, for applicants and recipients it may include name, address, postcode, date of birth, National Insurance number, phone numbers, case reference numbers, answers entered in the Client and Cost Management System (CCMS), case start and end dates, costs and VAT, financial assessments of defendants and their partners, bank accounts and property and, in some cases, partially redacted payment card details. According to The Register, some records also include criminal charges, pleas, convictions and sentences.
For providers (around 2,000 law firms, barristers and non-profit organisations, according to BleepingComputer) the attackers took contracts, office locations, payment details and account credentials, including names and email addresses for the LAA Online portal. The Record and SecurityWeek also mention names of judges, defence and prosecution lawyers, court reporters in Crown Court trials and opposing parties in some civil cases.
Probation: names, dates of birth, nationalities and case reference numbers were exfiltrated for a relatively small number of people supervised by the probation service between 2010 and 2017. According to The Register, more than 99% relates to 2016 and 2017, and none of the data concerns victims of crime.
Technical details
The sources say little about the attack vector. According to The Record, justice minister Sarah Sackman explained in a written statement to Parliament that criminals exploited vulnerabilities in the LAA’s IT systems, gained access to systems holding personal information, and copied and exfiltrated some of the data. No vulnerabilities have been named, there are no public CVEs or indicators of compromise, and no source attributes the attack to a specific group.
The Record reports that the attackers claimed to hold data on more than 2 million people and demanded payment, threatening to publish it; the UK government does not pay extortion demands. The ministry now says it has no indication that the data has been published or shared, whereas in May 2025 a spokesperson had described publication as a matter of “when, not if”.
On why it took 18 months, the agency explains that the stolen data came from several complex systems and was largely unstructured, fragmented or incomplete. Since the attack the ministry has strengthened authentication and access controls, improved security monitoring, fixed vulnerabilities and begun retiring or isolating higher-risk legacy systems; it is working with the National Crime Agency, the NCSC and the ICO. The Register notes that the update does not explain why records from the 1970s were still accessible.
Impact for European and Italian organisations
The case lines up three problems that are just as common in Europe. The first is retention: the GDPR requires data to be kept only as long as necessary, and every forgotten archive becomes material for extortion. The second is unstructured data: if you do not know where your data lives, after a theft you cannot say who is affected, and notifications to the supervisory authority and to data subjects arrive late or must be corrected several times. The third is supplier credentials: anyone accessing a public or corporate portal with credentials reused elsewhere becomes a risk to other systems too.
For NIS2 entities, including many public administrations, the ability to establish the scope of an incident quickly is needed to meet the deadlines for reporting to the CSIRT. The issue is just as sensitive for law firms, public bodies and healthcare, which handle judicial or special-category data.
What to do now
- Map your data, including unstructured data and legacy systems: where it is, who it belongs to, how long it has been there.
- Enforce retention periods: delete or move offline whatever is no longer needed.
- Isolate legacy systems you cannot update and restrict who and what can reach them.
- Watch outbound data: alerts on exports and external transfers that are unusual in volume or timing.
- Protect supplier accounts with multi-factor authentication; after a breach, force password changes.
- Keep enough logs to reconstruct what was read and copied, and prepare a plan to analyse exfiltrated data quickly.
How ARXDOME helps
ARX Shield shows open vulnerabilities per machine, highlighting those already exploited, and lets you isolate a suspicious machine from the network. ARX Expose flags known vulnerabilities on public services and company accounts involved in breaches. ARX Retain keeps logs for the years required, so after an incident you can reconstruct what happened and when.
Last updated:
