The UK’s Legal Aid Agency (LAA) says the data stolen in last year’s cyber-attack is older than it first thought, with some records dating back to 1978. In an update published on GOV.UK on 14 October 2026, the agency said “approximately 250,000 records predate 2007.”
What the agency now says
The LAA identified the attack on 23 April 2025. On 16 May 2025, it said, “we established that the attack was more extensive than originally understood and that the criminal group behind it had accessed and exfiltrated a significant amount of personal data.” The agency has not named the attackers.
Most of the stolen data relates to applications, claims or payments made between January 2007 and 16 May 2025. But further analysis has found older records. “The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978,” the LAA said.
The agency’s tables give examples. For people who applied for civil legal aid while on certain benefits, data from benefit checks “between 1978 and 2012” may include the name, date of birth, National Insurance number and address of the person receiving the benefit. Payment records for some very expensive criminal cases go back to 1981.
Probation data too
The LAA said it also found probation data in the stolen material: names, dates of birth, nationalities and case reference numbers for “a relatively small number of offenders” supervised between 2010 and 2017, more than 99% of them between 2016 and 2017. “None of this data relates to victims of crime,” it said.
Has it been published?
“We have no indication that the stolen data has been published or shared,” the LAA said. It stressed that having old records in the stolen data “does not mean that everyone who received or applied for legal aid … before 2007, has been affected.”
The agency advises anyone who thinks they may be affected to watch for suspicious messages, emails and calls, check the identity of anyone asking for sensitive information, and use strong passwords that are not reused.
Spending on fixes
A Ministry of Justice spokesperson told BleepingComputer: “We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services.” The spokesperson said £20 million had already been committed before the attack.
What this means
- Old data is still a risk. Records kept for decades were exposed in one attack.
- Not everyone is affected. Being on legal aid in the past does not mean your data was taken.
- Stay alert. Scammers may use stolen details to make messages look genuine.
Sources
- GOV.UK, Legal Aid Agency, “Legal Aid Agency cyber security incident data update October 2026”, 14 October 2026. https://www.gov.uk/government/news/legal-aid-agency-cyber-security-incident-data-update-october-2026
- BleepingComputer, “UK Legal Aid Agency: Hackers stole records dating back to 1978”, 15 October 2026. https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/
Related stories
- UK Data Watchdog Reprimands the Met Police Over Officers’ Unapproved Use of the Auror Retail-Crime Platform
- South Korea’s Financial Hacks Spread to 16 Firms, Including the Operator of Crypto Exchange Gopax; About 100,000 Records Presumed Leaked
- UK CNI Under Attack: 93% Hit by Successful Cyber Attacks — and the Defences Aren’t Keeping Up
