Legal Aid Agency breach includes records dating back to 1978
A new government assessment says about 250,000 stolen records predate 2007.
The Legal Aid Agency has confirmed that data taken in last year’s cyber-attack includes records dating back to 1978. About 250,000 affected records predate 2007, although the agency says that does not mean everyone who used legal aid before then was affected.
The updated assessment was published by the Legal Aid Agency on Wednesday after further analysis of data taken from its systems. The agency said most of the affected material relates to applications, claims or payments submitted between January 2007 and May 2025, or to cases that were live during that period.
The newly confirmed older records are mainly from the 1990s and 2000s. Only a very small proportion dates from before 1990, but the earliest record currently verified was created in 1978. The agency did not publish a figure for the total number of people potentially affected.
The information that may have been taken varies between individuals. It can include names, dates of birth, National Insurance numbers, addresses, case references, financial information and details about legal proceedings. Some records also contain information about legal representatives, including provider contracts, office details and banking information.
The Ministry of Justice said the same attack also exposed some probation-service data. That material includes some names, dates of birth, nationalities and case references for a relatively small number of people who were actively managed by probation services between 2010 and 2017. The agency said none of the probation data concerned victims of crime.
The attack was identified in April 2025, after which the agency worked with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office. The agency said it had no indication that the stolen data had been published or shared, while an injunction obtained in 2025 remains in place to prevent unlawful use or disclosure.
The government says it has strengthened authentication and access controls, improved monitoring and begun retiring or isolating higher-risk technology. The long time span of the records underlines the difficulty of investigating legacy systems, but the agency has not said who carried out the attack or whether any individuals have misused the data.
One story, several perspectives
What is established
- The Legal Aid Agency published a new assessment on 14 October 2026.
- Approximately 250,000 affected records predate 2007, with the earliest verified record dating from 1978.
- The agency says not everyone within the listed periods was affected and that it has no indication the data has been published or shared.
Left
Arguments The breach shows the public cost of years of underinvestment in justice technology. The priority should be stronger public-sector systems, transparent support for affected people and sustained funding for legal aid rather than treating cybersecurity as a narrow technical issue.
Values Public access to justice, equality, accountability and protection of vulnerable people.
Consequences Failure to invest could deepen distrust and make people less willing to seek legal help, while rushed digitisation could create further risks.
Centre
Arguments The immediate task is to establish exactly whose data was taken, notify people where possible and complete the technical investigation. Modernisation is necessary, but it should be accompanied by independent oversight, proportionate data retention and reliable contingency arrangements.
Values Institutional competence, due process, privacy and evidence-led reform.
Consequences A measured response may take longer, but it reduces the risk of over-notifying people, misidentifying victims or disrupting access to legal representation.
Right
Arguments Government agencies should face the same hard security standards expected of private organisations handling sensitive information. Legacy systems should be replaced quickly, senior responsibility should be clear and access to large datasets should be tightly limited.
Values Security, personal responsibility, efficiency and protection of taxpayers and citizens.
Consequences Stricter controls may increase costs and reduce convenience for providers, but weak systems expose people to avoidable risks and impose wider costs on the state.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article is based on the agency’s latest official data assessment and an independent security report. Unknowns are clearly attributed and no unsupported conclusion about individual victims is made.
- confirmed About 250,000 affected records predate 2007. — Stated in the Legal Aid Agency’s October 2026 update. source
- confirmed The earliest verified record dates from 1978. — Stated in the same official update. source
- confirmed The affected information can include legal, financial and identity data. — The agency lists these categories in its affected-data tables. source
- confirmed Some probation-service data was also exfiltrated. — Confirmed in the agency’s section on HMPPS information. source
- confirmed The agency has no indication that the stolen data was published or shared. — This is the agency’s stated current assessment. source
Editor's note
The new development is the Legal Aid Agency’s 14 October assessment. The scale of the affected population, the attackers’ identity and any misuse of the data remain uncertain.Sources
- Legal Aid Agency cyber security incident data update October 2026 — Legal Aid Agency
- UK Legal Aid Agency: Hackers stole records dating back to 1978 — BleepingComputer
More on this in other media
- The Independent — „cybersecurity legal aid”
- BBC News — „cybersecurity legal aid”
- The Guardian — „cybersecurity legal aid”