Summary
- Around 250,000 records predate 2007; the earliest verified dates to 1978.
- Some probation service data was also exfiltrated, the agency confirms.
- Officials say there is no indication the stolen material has been published or shared.
The Legal Aid Agency has confirmed that approximately 250,000 records predating 2007 were contained in data stolen during a cyberattack detected in April 2025. A further review has also identified some information relating to people managed by probation services, extending the known scope of the incident beyond the categories previously described publicly.
The agency published its updated assessment on 14 October 2026 after continuing forensic and data analysis. Most of the affected legal aid material relates to applications, claims or payments made between January 2007 and May 2025, or cases live within that interval. The newly identified older material is concentrated in the 1990s and 2000s, with the earliest verified record dating to 1978.
A historic legal aid application alone does not establish that any particular person’s records were accessed. The agency explicitly warns that inclusion within a historic date range is not proof that a particular individual's record was taken. Likewise, the possible data types listed in its public notice are not necessarily present for every affected person.
The update also describes a relatively small set of probation records associated with HM Prison and Probation Service. Those records concern offenders managed between 2010 and 2017, with more than 99% of the identified data relating to 2016 and 2017. Names, dates of birth, nationalities and case reference numbers are among the categories noted. The agency says none of this material concerns victims of crime.
The 2025 attack affected online systems used by the agency, and an investigation subsequently established that attackers had accessed and exfiltrated a substantial volume of personal information. The October statement says the organisation has no indication that the stolen data has been published or shared. That is a limit on what is currently known, rather than a guarantee that the material cannot be misused.
A major complication has been the nature of the data itself. The agency says the compromised material included unstructured, fragmented and incomplete information held across complex digital systems. Mapping records back to specific periods and people can therefore continue long after the initial technical response, even where investigators know that information left the environment.
Historic case files can contain identity, financial and legal information that remains sensitive even when the original proceeding is long closed. Some records can also refer to family members, other parties or legal professionals who did not directly apply for assistance. The agency's detailed notice separates categories of people and possible attributes to avoid presenting the entire dataset as uniform.
The Ministry of Justice and Legal Aid Agency say they have strengthened authentication, access controls and security monitoring, addressed vulnerabilities, isolated or retired higher-risk technology, and pursued modernisation work. Those actions are part of the stated response, not proof that every legacy dependency has disappeared. The government continues to work with the National Cyber Security Centre and other authorities.
The retrospective work also changes the practical meaning of breach notification. An initial warning may tell people that a system has been attacked, while a later notice gives a more useful account of the exact records that were taken. Here, the evidence is dispersed across long-lived case management systems and formats, making a complete person-by-person inventory unusually difficult. The revised notice contains detailed date ranges because the systems and datasets did not all cover the same period. Those distinctions help avoid both under-reporting older material and unnecessarily suggesting that everybody who interacted with the justice system over several decades is an affected person. The agency's latest statement still stops short of identifying every individual whose information was exfiltrated.
The October disclosure refines the population and age of records known to have been stolen. It leaves individual exposure dependent on the agency's continuing analysis and the limits of the available forensic evidence.
