UK Legal Aid Agency breach update: the 2025 attackers took about 250,000 records older than 2007, the earliest from 1978, plus probation data from HM Prison and Probation Service
The UK Ministry of Justice published an update on 14 October 2026 on the cyber-attack it identified on 23 April 2025 against the Legal Aid Agency (LAA), the executive agency that runs legal aid in England and Wales. By 16 May 2025 the MoJ had established that the criminal group behind the attack had exfiltrated a large amount of personal data about legal aid applicants and providers. Further forensic analysis now shows that most of the stolen data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period, but about 250,000 records predate 2007. Most of those are from the 1990s and 2000s, a very small number predate 1990, and the earliest verified record is from 1978. The analysis also found that probation data from HM Prison and Probation Service was in the exfiltrated material; the MoJ says none of it relates to victims of crime. Earlier disclosures listed applicant contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as contributions, debts and payments, plus provider contracts, financial information and LAA Online Portal credentials. The MoJ says the data involved varies greatly between individuals, a pre-2007 record does not mean everyone who dealt with legal aid back then is affected, and it has no indication the stolen data has been published or shared. It is working with the National Crime Agency, the NCSC and the Information Commission. A Ministry of Justice spokesperson told BleepingComputer it is now investing more than £200 million in modernising legal aid digital services and cyber security. Primary: GOV.UK notice; wire: BleepingComputer.
- Product
- UK Legal Aid Agency online digital services and Ministry of Justice legal aid records
- Versions
- n/a — incident (attack identified 23 April 2025; data scope updated 14 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- People who applied for or worked on legal aid in England and Wales: follow the MoJ guidance on GOV.UK and treat calls or emails about legal aid, debts or court matters with suspicion. Agencies holding decades of case data: check retention against legal need, because old records still widen breach scope years later.
Primary: GOV.UK (Ministry of Justice) — Legal Aid Agency cyber security incident data update October 2026 (14 Oct 2026) · Vendor: Legal Aid Agency (Ministry of Justice, England and Wales) · BleepingComputer — UK Legal Aid Agency: Hackers stole records dating back to 1978 (15 Oct 2026)