Legal Aid Agency breach: stolen records date back to 1978
The UK's Legal Aid Agency (LAA) has confirmed that the data stolen in last year's cyberattack reaches much further back than first reported. Some of the records date from 1978.
The LAA is an executive agency of the Ministry of Justice and manages the country's Public Defender Service. It funds legal help for people who cannot afford a lawyer. Attackers breached its IT systems in April 2025, and the agency is still working out the full extent of what was taken.
A breach that kept getting bigger
The agency has around 1,250 staff and oversees billions in legal funding. It works with about 2,000 providers, including barristers, solicitor firms and non-profit organizations that deliver civil and criminal legal aid in England and Wales.
The LAA first disclosed the attack in early May 2025. At that point, it warned that payment information for legal aid providers might have been exposed.
Two weeks later, the picture changed. The agency found that attackers had taken a large amount of sensitive data on legal aid applicants and recipients going back to 2010. The stolen information included:
- contact details and dates of birth
- national ID numbers
- criminal history
- employment status
- contribution amounts, debts and payments
Provider data was also taken. This covered provider contracts, office locations, financial information, contact details, and LAA Online Portal credentials, including names and email addresses.
Around 250,000 records predate 2007
In an update published this week, the LAA said further analysis of the exfiltrated data shows the records go back almost five decades.
"The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007," the agency said.
"The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978."
The agency added that the presence of older records does not mean that everyone who applied for or received legal aid, or dealt with the justice system before 2007, was affected.
Ministry of Justice points to new investment
A Ministry of Justice spokesperson told BleepingComputer that the government published information on GOV.UK quickly and has kept updating it as its understanding of the attack developed.
"Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency's digital systems. We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services," the spokesperson said.
"There is currently no evidence that any personal data believed to have been exfiltrated has been published."
Part of a wider wave of UK incidents
The LAA breach was followed by a series of attacks on UK retailers Co-op, Harrods and Marks & Spencer (M&S), which were claimed by the DragonForce ransomware operation. Retail has remained a target since, as the recent TFG London attack on fashion brands shows.
After these incidents, the National Cyber Security Centre (NCSC), the UK's technical authority for cyber security, published guidance and urged UK organizations to follow it to harden their defenses.
In January, the UK government also announced a new cybersecurity strategy, backed by more than £210 million ($283 million), to improve defenses across government departments and the wider public sector.
The public sector is still under pressure. This week, the UK Housing Ombudsman Service said it is investigating a third-party IT security incident that affected its case management system. The service is a non-departmental public body sponsored by the Ministry of Housing that settles disputes between social housing residents and social landlords in England.
Why It Matters
The most worrying detail is not the age of the records alone. It is the type of data. Criminal history, debts and national ID numbers do not expire. Someone who applied for legal aid in the 1990s may now have a very different life, and having that history exposed could be used for extortion, fraud or targeted social engineering. The Silent Ransom Group's focus on US law firms shows how much criminals value legal data.
The case also follows a familiar pattern. The scope grew from provider payment data, to applicant data from 2010, and now to records from 1978. Similar step-by-step revisions have appeared in other large incidents, such as the rising Oracle Health breach tally. This suggests organizations often do not have a full picture of what they store until after it is stolen. Keeping decades of sensitive records in reachable systems clearly increases the impact when a breach happens.
It is worth watching whether the stolen data appears on leak sites, since the ministry says there is no evidence of that so far. Another question is whether the £200 million modernization effort includes data retention reviews, not just system upgrades. Anyone who dealt with legal aid in England and Wales should remain alert to unexpected contact that refers to their case history.