Short answer
On 14 October 2026 the UK Legal Aid Agency published an update on its April 2025 cyber-attack. After deeper analysis it says the stolen data includes about 250,000 records from before 2007, with the earliest verified record from 1978. It has no indication the data has been published.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Legal Aid Agency (UK Ministry of Justice) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Government and legal services |
| Country | United Kingdom |
| Detected | 2025-04-23 |
| Disclosed | 2026-10-14 |
| People or records affected | Legal aid applicants, recipients, providers and others over several decades; about 250,000 stolen records predate 2007 |
What data was exposed
- For some applicants and recipients: name, date of birth, National Insurance number, address, case details and costs
- For some criminal legal aid cases: offences charged, plea, conviction status and sentence
- For some civil cases: financial and legal merit assessments, and sometimes partner and family details
- For legal aid providers: bank account name, number and sort code, contracts, and online portal user names and emails
- For a relatively small number of probation service users: some names, dates of birth, nationalities and case references
What happened
The Legal Aid Agency (LAA), the part of the UK Ministry of Justice that funds legal aid in England and Wales, identified a cyber-attack on its online digital services on 23 April 2025. By 16 May 2025 it found the attack was more extensive than first understood and that a criminal group had taken a significant amount of personal data.
On 14 October 2026 the agency published an update. Specialist teams had analysed the stolen data, which was largely unstructured, fragmented or incomplete, and that changed what the LAA understands about the date range and the types of data involved. BleepingComputer reported the update on 15 October under the headline that stolen records date back to 1978.
The scale and the date range
According to the update, about 250,000 stolen records predate 2007. Most are from the 1990s and 2000s, a fraction are from before 1990, and the earliest verified record is from 1978. The agency stresses that this does not mean everyone who applied for legal aid before 2007 was affected.
The update also says the data on offenders supervised by probation services concerns a relatively small number of people, with more than 99% of it relating to people supervised in 2016 to 2017.
Who and what may be affected
The LAA sets out affected groups in detail, and says the data varies by individual. Examples include:
- Civil legal help and mediation recipients with solicitor cost claims from January 2000 to May 2025, where names, dates of birth and National Insurance numbers could be involved.
- Crown Court legal aid recipients with grants from March 2010 and decisions before July 2018, where addresses, offence categories, employment and bank account details could be involved.
- Civil cases on its case management system between March and May 2025, where full answers to application questions and financial assessments could be involved.
- People owing civil debts to the agency, with debt amounts and payment details from April 2019 to December 2025.
- Legal aid providers, including solicitors and barristers, where bank account details, contracts and online portal user names and emails could be involved.
- Others linked to cases, such as judges’ names as they appear in court records and opponents in civil cases.
Response and what the agency says
The LAA says the Ministry of Justice and the agency are strengthening authentication and access controls, improving monitoring and modernizing legacy systems, working with the National Cyber Security Centre. The ministry told BleepingComputer it had committed 20 million pounds to stabilize and upgrade the agency’s digital systems before the attack and is now investing more than 200 million pounds in digital modernization and cybersecurity. The agency has not described how the attackers got in.
What to watch for
The agency advises staying alert to suspicious messages, being cautious about unexpected requests for personal or financial information, verifying identities independently and avoiding password reuse. Practitioners should apply the same caution to requests involving banking details or portal access.
Our data breach checklist explains the next steps, and the guide to government impersonation scams covers fake officials. For a related regulator-run register hit in the same weeks, see the Danish CPR register breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls, emails or texts from people posing as the Legal Aid Agency, a solicitor or a court who ask for payment or bank details.
- Messages that use details of a past case, such as costs or dates, to pressure you into 'settling a debt'.
- Blackmail attempts that threaten to expose a past legal matter, which the agency says it has no indication has been published.
- Fake requests aimed at legal aid practitioners to change bank details or reset portal access.
What to do if you are affected
- 01Check the agency's published list of affected groups, but remember that belonging to a group does not mean your data was taken.
- 02Verify the identity of anyone who contacts you about legal aid before you share personal or financial information.
- 03Use strong, unique passwords and do not reuse them across accounts.
- 04Practitioners should confirm any request to change banking details or portal access through a known number.
- 05Call the Legal Aid Agency customer services team on 0300 200 20 20 (9am to 5pm, Monday to Friday) with questions.
Frequently asked questions
When did the Legal Aid Agency attack happen?
The agency identified the cyber-attack on 23 April 2025. By 16 May 2025 it found the attack was more extensive than first understood and that a significant amount of personal data had been taken. The 14 October 2026 update refines which data and which years are affected.
Was my data stolen if I received legal aid?
Not necessarily. The agency says being in one of the listed groups, or having had contact with probation services, does not by itself mean your information was in the stolen data. Records also vary by person.
Has the stolen data been published?
The agency says it has no indication that the stolen data has been published or shared. The Ministry of Justice made the same statement.
What is the Legal Aid Agency doing now?
It says it is strengthening authentication and access controls, improving security monitoring, fixing vulnerabilities, retiring or isolating higher-risk technology and modernizing legacy systems. It is working with the National Cyber Security Centre and has informed the Information Commissioner's Office.
Sources
- Legal Aid Agency cyber security incident: data update, October 2026, GOV.UK, 2026-10-14
- UK Legal Aid Agency: Hackers stole records dating back to 1978, BleepingComputer, 2026-10-15
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.