The UK Legal Aid Agency (LAA), the Ministry of Justice body that funds legal help in England and Wales, says the cyberattack it first disclosed in 2025 took far older data than it first reported. In an update published on 14 October, the agency said about 250,000 stolen records predate 2007, mostly from the 1990s and 2000s, and the earliest verified record dates from 1978. When the breach was confirmed in May 2025, the agency had described stolen applicant and recipient data from 2010 onward.
The agency also said the stolen material includes probation data held for HM Prison and Probation Service, covering names, dates of birth, nationalities and case reference numbers, according to The Record. It said none of this data relates to victims of crime. Depending on the case, the stolen records can include full names, dates of birth, National Insurance numbers, case start and end dates, costs claimed and the type of legal aid received. They can also include financial assessments of defendants and their partners, bank and property details, and in some cases partially redacted payment card details. The names of judges, lawyers and court reporters involved in Crown Court trials, and details of opposing parties in some civil cases, were taken too.
The agency stressed that having records from before 2007 does not mean everyone who dealt with legal aid or the justice system in that period was affected, and that what was taken varies from person to person. It said much of the stolen data was “unstructured, fragmented, or incomplete”, which made the analysis slow. Justice Minister Sarah Sackman told Parliament the department has no indication the stolen data has been published or shared. The Record notes that this differs from the ministry’s view in May 2025, when a spokesperson said publication was a question of “when, not if”, and that the attackers had claimed to hold data on more than 2 million people. The ministry says it has since strengthened authentication, access controls and monitoring, and is retiring or isolating higher-risk legacy systems; BleepingComputer reports it is investing more than 200 million pounds in modernising legal aid digital services.