The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in a data breach in April 2025.
In May last year, the British Ministry of Justice said that hackers had accessed and taken the personal data of people applying for legal aid, but did not share the full extent of the incident.
An Update the event Published this week revealed that most of the compromised records were related to applications, claims, and payments submitted between 2007 and 2025.
However, academic investigators confirmed that there were approximately 250,000 compromised records in 2007.
“Most of these are from the 1990s and 2000s, with a small number from before 1990. The first confirmed records are now from 1978,” the update read.
Compromised information relating to legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance numbers, postcodes, case reference numbers, responses entered into the LAA’s Client and Costs Management System (CCMS), telephone numbers and other types of information.
The hackers also extracted information related to legal aid practitioners associated with the LAA, including contracts, schedules, office locations, payment details, and user account credentials.
Other individuals affected include judges, attorneys, advocates, other parties to civil litigation, and individuals who manage payment sites.
“Our enhanced cyber capabilities have also identified that information relating to Probation Service users was accessed. Data extracted by the attackers included names, dates of birth, nationalities, and case reference numbers for a small number of offenders actively managed by the Probation Service between 2010 and 2017,” the LAA said.
According to the agency, its investigation into the incident took a long time because the attack involved many systems and large amounts of data, most of which were unstructured, fragmented, or incomplete.
“This has made data analysis complex. Therefore, since the incident, technical experts and data teams have worked extensively to understand what data the attackers have accessed and extracted,” the agency said.
The LAA also emphasized that there is no evidence that the stolen data has been disclosed to the public or sold.
Related: CenterPoint’s energy data breach affected 1 million Texans
Related: The iRhythm data breach affected at least 360,000 people
Related: ASOS confirms cyber attack, data breach
Related: 8.8 million people were affected by the data breach in the Danish private registry
