Threat Intelligence · Privacy
Hackers steal decades of records from UK Legal Aid Agency
The UK's Legal Aid Agency says hackers stole sensitive records dating back to 1978, affecting applicants, recipients, and providers. The breach is under investigation and no stolen data has been published so far.
Ross Grant3 min read
The short version
Hackers broke into the UK's Legal Aid Agency and stole sensitive records, some dating back nearly 50 years. The stolen data includes personal details of people who applied for or received legal aid, as well as information about legal aid providers. The agency is investigating and says there is no evidence yet that the stolen data has been published online.
By the numbers
- 1978Earliest year of stolen recordsBleepingComputer
- 250,000Records predating 2007 stolenBleepingComputer
- £200 millionInvestment in digital security after breachBleepingComputer
- 1,250LAA staff potentially affectedBleepingComputer
- 2,000Legal aid providers working with LAABleepingComputer
What happened?
Hackers breached the UK Legal Aid Agency's IT systems in April 2025 and stole records dating back to 1978. The agency confirmed the breach in May 2025 and later revealed that sensitive data from applicants, recipients, and providers was taken. There is no evidence so far that the stolen data has been published.
What data was stolen?
The Legal Aid Agency (LAA), part of the UK's Ministry of Justice, confirmed that hackers accessed and stole a large amount of sensitive data from its IT systems. The breach, which took place in April 2025, was first disclosed in May 2025. Initial investigations suggested that payment details for legal aid providers might have been compromised. However, further analysis revealed the situation was more serious.
Attackers took records going back as far as 1978. Most of the stolen data covers applications, claims, or payments made between January 2007 and May 2025, or cases that were active during that time. About 250,000 records are from before 2007, with the oldest confirmed from 1978. The agency stressed that not everyone who interacted with the justice system before 2007 is affected, only those whose records were still held in the systems.
The stolen information includes:
- Contact details, dates of birth, and national ID numbers
- Criminal history and employment status
- Contribution amounts, debts, and payments for legal aid
- Legal aid providers’ contracts, office locations, financial information, and online portal credentials
Who is affected?
The LAA manages legal aid services across England and Wales, working with about 2,000 providers and employing around 1,250 staff. The breach affects both individuals who applied for or received legal aid and the organisations that provide these services. The agency has not yet published a full list of affected people or providers. There is currently no evidence that any of the stolen personal data has been published online, according to the Ministry of Justice.
How has the agency responded?
The LAA said it published information about the breach on the UK government website as quickly as possible and has continued to update it as new details emerge. Before the attack, the agency had already committed £20 million to stabilise and upgrade its digital systems. In response to the breach, investment has increased to over £200 million to modernise digital services and strengthen cybersecurity across legal aid services.
A Ministry of Justice spokesperson said, “We recognise that incidents of this nature are concerning for anyone affected.” The National Cyber Security Centre (NCSC) has published guidance for UK organisations to help strengthen their defences. The UK government also announced a new cybersecurity strategy in January, backed by more than £210 million, to improve security across public sector organisations.
What should affected people do?
Anyone who has applied for or received legal aid since 1978, or who works as a provider, should be alert for signs of identity theft or fraud. Watch for suspicious emails, phone calls, or letters, especially those asking for personal or financial information. The LAA has not said if it will contact affected individuals directly, so those concerned may wish to check the official GOV.UK website for updates.
What happens next?
The investigation is ongoing. The LAA and Ministry of Justice are working with cybersecurity experts to understand the full impact and to prevent future incidents. There is no confirmation yet of how the attackers gained access or whether any data has been misused. The breach comes amid a series of cyberattacks on UK organisations, highlighting the risks faced by public sector bodies handling sensitive information.
Uncertainties
This story has only been reported by BleepingComputer so far. There is no primary confirmation from the LAA or Ministry of Justice published at the time of writing. Details about how the attack happened and the exact number of people affected remain unclear.
Read the original report at BleepingComputer. (opens in a new tab)
Claimed vs confirmed
- Confirmed
Hackers stole records dating back to 1978 from the LAA.
The LAA confirmed records as old as 1978 were stolen, according to BleepingComputer.
- Confirmed
Stolen data has not been published online.
The Ministry of Justice said there is no evidence that stolen data has been published.
The impact
- Money
- The agency has committed over £200 million to improve cybersecurity. Under UK GDPR, fines for such breaches can reach up to £17.5 million or 4% of global turnover, though no fine has been announced.
- Reputation
- Trust in the Legal Aid Agency may be affected, especially given the long period covered by the breach. The agency has been open about the incident and is investing in improvements.
- Customers
- People who have used legal aid services since 1978, as well as providers, may be at risk of identity theft or fraud. They should watch for suspicious activity and check official updates.
Why it matters
This breach affects people who have used legal aid services in England and Wales, as well as the organisations that provide those services. Sensitive personal and financial information is now at risk, which could lead to identity theft or fraud. The incident highlights the importance of strong cybersecurity for public sector organisations.
How does it work?
The specific method the attackers used to breach the Legal Aid Agency's systems has not been disclosed. It is not yet clear how access was gained or what vulnerabilities were exploited.
Key points
- Hackers stole records from the UK Legal Aid Agency dating back to 1978.
- Sensitive data from applicants, recipients, and providers was compromised.
- The agency is investing over £200 million to improve cybersecurity.
- No evidence yet that stolen data has been published online.
- The full method of attack and number of affected people remain unclear.
Sources
BleepingComputer
Reference
