The Legal Aid Agency (LAA), an executive agency of the UK’s Ministry of Justice that manages the country’s Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
The agency employs around 1,250 staff, oversees billions in legal funding, and works with approximately 2,000 providers, including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales.
The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised.
Two weeks later, it confirmed the resulting data breach was more serious than first believed after finding that attackers had stolen a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, as well as contribution amounts, debts, and payments.
The threat actors have also stolen legal aid providers’ data, including provider contracts, office locations, financial information, contact details, LAA Online Portal credentials (including names and email addresses), and more.
In an update published this week, the LAA said follow-up analysis of the exfiltrated data found that the stolen records go back almost five decades.
“The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007,” the agency said. “The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978.”
However, it noted that records predating 2007 do not mean everyone who received, applied for legal aid, or interacted with the justice system before 2007 was affected.
“We recognise that incidents of this nature are concerning for anyone affected. That is why we published information on GOV. UK as quickly as possible and have continued to update it as our understanding of the cyber-attack has developed,” a Ministry of Justice spokesperson told BleepingComputer.
“Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency’s digital systems. We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services. There is currently no evidence that any personal data believed to have been exfiltrated has been published.”
After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains claimed by the DragonForce ransomware operation, the country’s National Cyber Security Centre (NCSC) published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
In January, the UK also announced a new cybersecurity strategy, backed by more than £210 million ($283 million), to boost cyber defenses across government departments and the wider public sector.
This week, the UK Housing Ombudsman Service, a non-departmental public body sponsored by the Ministry of Housing that settles disputes between social housing residents and social landlords in England, disclosed that it is investigating a third-party IT security incident that impacted its case management system.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
UK Housing Ombudsman Service investigates ‘security incident’
Valve notifies Steam hardware customers of a data breach
French tax authority data breach affects 678,000 individuals
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
Hackers stole Pentagon personnel records of over 3 million people
Ledger confirms spy chip implant behind wallet crypto thefts
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
GitLab warns of max severity code execution vulnerability
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
Overdue a password health-check? Audit your Active Directory for free
Get a full picture of your validation coverage, beyond what pentesting can see.
AI is a data-breach time bomb: Read the new report
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
