Legal Aid Agency hackers made off with records dating back to 1978

If you had legal aid applications, claims, or payments processed before 2007, your historical data may have been exposed.

Hackers who breached the UK's Legal Aid Agency (LAA) in April 2025 exfiltrated records dating back to 1978, a far more extensive haul than initially reported. The Ministry of Justice (MoJ) revealed that around 250,000 records compromised in the attack originate from before 2007, with most from the 1990s and 2000s, and a small fraction pre-1990. In addition to LAA data, the breach also compromised records from HM Prison and Probation Service (HMPPS), including personal details and case numbers for offenders supervised between 2010 and 2017. The LAA's online services were taken offline following the intrusion, causing months of disruption for legal aid providers. The MoJ stated that the extended timeline for identifying the full scope of the breach was due to the fragmented and unstructured nature of data across multiple complex systems, and that they have since enhanced security measures.

The prolonged discovery of the breach's true scope, nearly 18 months after the initial intrusion, highlights significant deficiencies in the UK government's ability to manage and secure legacy data. The fact that records from the 1970s and 1980s were accessible in systems breached in 2025 raises critical questions about the effectiveness of ongoing modernization efforts and the risk appetite for maintaining such old, potentially vulnerable, data. This incident underscores a systemic issue where aging IT infrastructure continues to pose a substantial cybersecurity threat, even as agencies claim to be implementing enhanced security protocols.

The compromise of probation service records alongside LAA data suggests a broader vulnerability within the justice system's digital infrastructure. This dual breach affects a different but equally sensitive segment of the population, potentially impacting offender rehabilitation and public safety monitoring. The MoJ's emphasis on the data not relating to victims of crime, while reassuring, does not diminish the severity of personal information being in the hands of malicious actors, especially for individuals undergoing supervision. Future focus will likely be on how the government addresses the inherent risks of deeply entrenched legacy systems and the challenges of securing comprehensive, interconnected databases.