A review of the UK Legal Aid Agency cyberattack has widened the known scope of the stolen data, identifying approximately 250,000 records created before 2007 and confirming that the earliest verified record dates from 1978.
The breach occurred in April 2025 and was publicly disclosed in May 2025. At that point, the agency said attackers had accessed and exfiltrated personal information associated with people who had applied for legal aid through its online service since 2010. The more recent assessment extends the principal data period back to January 2007 and identifies older records outside that range.
The findings do not establish how many people are affected. A record is not necessarily a unique individual, and the LAA has cautioned that the presence of pre-2007 material does not mean everyone who dealt with legal aid or the justice system before that year was involved.
Review identifies a much longer data period
According to SecurityWeek’s report on the LAA update, the compromised environment contained large amounts of fragmented, incomplete or unstructured information spread across multiple systems. That made it harder for investigators to determine precisely what had been accessed and copied.
The main dataset covers applications, claims and payments submitted from January 2007 through 16 May 2025, as well as cases that remained live during that period, The Record reported.
Investigators also identified approximately 250,000 older records. The LAA said most of those date from the 1990s and 2000s, while only a “fractionally small number” predate 1990. The earliest record verified in the review is from 1978.
A separate portion of the compromised material concerns a relatively small number of offenders actively managed by Probation Services between 2010 and 2017. Reported fields include names, dates of birth, nationalities and case reference numbers.
Financial, identity and case information was involved
The data attributed to legal aid applicants and recipients includes:
- names and dates of birth;
- National Insurance numbers;
- case reference numbers;
- case start and end dates;
- legal aid type and equality-monitoring codes;
- postcodes, addresses and telephone numbers;
- costs and VAT claimed or paid;
- answers entered in the Client and Cost Management System;
- financial assessments concerning defendants and their partners;
- bank account and property information;
- partially redacted payment card details in some cases.
The affected systems also held information about legal aid practitioners, including contracts, schedules, office locations, payment details and user account credentials.
Other records may identify judges, solicitors, advocates, prosecution and defence lawyers, court reporters, parties in some civil proceedings and managers of pay point locations. The presence of these categories means the consequences are not limited to people who directly submitted legal aid applications.
Charities have raised particular concerns that the stolen material could contain sensitive information about women and girls who survived domestic abuse. That is a risk identified by the charities, rather than a confirmed finding about particular individuals. Criminal-history information was also among the categories potentially involved in the May 2025 disclosure.
Attackers exploited weaknesses across LAA systems
Justice Minister Sarah Sackman told Parliament that criminals exploited vulnerabilities in LAA IT systems, reached systems containing personal data and then copied and removed some of that information.
The description indicates that the intrusion affected multiple systems rather than a single database. The volume and inconsistent structure of the information have required specialist technical and data teams to reconstruct what the attackers obtained.
The attackers claimed to possess information on more than 2 million people and threatened to release it unless they were paid. That figure remains an attacker assertion, not a verified count of affected individuals. The UK government maintains a policy of refusing extortion payments.
The LAA says it has found no evidence that the stolen information has been publicly released or sold. Sackman similarly told Parliament there was no indication that it had been published or shared. That is a change from the position expressed by a ministry spokesperson in May 2025, who said publication was a matter of “when, not if.”
Authentication and legacy-system controls tightened
The Ministry of Justice has strengthened authentication and access controls, expanded security monitoring and started retiring or isolating higher-risk legacy systems. It is also working with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office.
For people whose identity, financial or case information may be involved, the combination of National Insurance numbers, contact details and legal case references could make deceptive messages appear credible. Unsolicited communications that cite genuine case details should therefore be verified through established contact channels rather than through links or telephone numbers contained in the message.
Practitioners whose account credentials may have been stored in the affected systems should avoid reusing the same passwords on other services and change any reused credentials. People whose bank or partially redacted card information was involved should also watch for unexpected transactions and suspicious requests that refer to legal aid payments or cases.
