Thursday 15 October 2026
Evening Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

UK Legal Aid Agency confirms hackers stole records dating back to 1978

Agency says 250,000 records predate 2007, with earliest verified from 1978, as part of attack disclosed in April 2025

By LineZotpaper
Published
Read Time3 min
The UK Legal Aid Agency (LAA) has revealed that hackers who breached its systems in April 2025 stole records dating back to 1978, with approximately 250,000 records predating 2007. The agency, which manages legal aid for England and Wales, said the vast majority of stolen data relates to applications, claims or payments made between 2007 and May 2025, but confirmed a fractionally small number of records date from before 1990, with the earliest verified record from 1978.

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that oversees the Public Defender Service, initially disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised. Two weeks later, it confirmed the breach was more serious than first believed, with attackers stealing a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, and financial contribution details.

In an update published this week, the LAA said follow-up analysis found that stolen records go back almost five decades. "The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007," the agency said. "The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978."

The agency noted that records predating 2007 do not mean everyone who received or applied for legal aid before that year was affected. Threat actors also stole legal aid providers' data, including contracts, office locations, financial information, and LAA Online Portal credentials.

A Ministry of Justice spokesperson told BleepingComputer: "We recognise that incidents of this nature are concerning for anyone affected. That is why we published information on GOV.UK as quickly as possible and have continued to update it as our understanding of the cyber-attack has developed." The agency said it had already committed £20 million to stabilising and upgrading the LAA's digital systems before the attack, and is now investing more than £200 million in modernising digital services and strengthening cybersecurity across legal aid services. The spokesperson added that there is currently no evidence that any stolen personal data has been published.

§

Analysis

Why This Matters

  • The breach exposes sensitive personal and financial data of legal aid applicants, recipients, and providers, potentially affecting hundreds of thousands of individuals in England and Wales.
  • Records spanning nearly five decades could be used for identity theft, fraud, or blackmail, with long-term risks to those whose data was compromised.
  • The incident raises questions about the security of legacy government IT systems that still hold decades-old records.

Background

The Legal Aid Agency manages legal aid funding for criminal and civil cases in England and Wales, employing around 1,250 staff and working with approximately 2,000 providers including barristers and solicitor firms. The breach was first detected in April 2025 and disclosed in early May, initially believed to have compromised only payment information but later found to involve a much larger dataset. The update in October 2026 revealed the extent of historical records exfiltrated.

The attack was part of a string of cyberattacks targeting UK organisations, including retail chains Co-op, Harrods, and Marks & Spencer, which were claimed by the DragonForce ransomware operation. The UK's National Cyber Security Centre issued warnings following these incidents.

Key Perspectives

Affected individuals and providers: Those whose data was stolen face potential identity theft and fraud. The agency has provided updates via GOV.UK but the long gap between the attack and full disclosure has caused concern. UK Ministry of Justice and LAA: The agency has acknowledged the seriousness, invested in system upgrades, and stated there is no evidence of data publication. They emphasise their commitment to transparency and security improvements. Cybersecurity experts: The breach underscores the risks of legacy IT systems in government, particularly the challenge of securing historical data that may not have been digitised with modern protections.

What to Watch

  • Whether the stolen data appears on dark web forums or is used in further attacks, potentially confirming the perpetrators' identity.
  • Progress of the £200 million digital modernisation programme and any interim security measures to prevent similar breaches.
  • Potential regulatory action from the UK Information Commissioner's Office and any compensation schemes for affected individuals.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe