Hackers have stolen sensitive records from the UK’s Legal Aid Agency (LAA), with investigations confirming that some of the affected records date back to 1978. The latest findings were announced on 14 October 2026 by the UK government. The agency operates under the Ministry of Justice and provides services that help people access legal aid. The discovery shows that the cyberattack exposed older records than officials initially understood.
The attack was first identified on 23 April 2025, when the agency discovered suspicious activity affecting its online digital services. Further investigation revealed on 16 May 2025 that criminals had accessed and downloaded a significant amount of personal information. Officials subsequently took steps to contain the incident and investigate its full extent. The attackers exploited vulnerabilities in the agency’s IT systems to access information held by the Ministry of Justice.
According to the latest government update, approximately 250,000 records predate 2007, although the vast majority of the stolen Legal Aid Agency data relates to the period between January 2007 and 16 May 2025. Most of the older records come from the 1990s and 2000s. Only a very small proportion dates back further, with the earliest verified record originating in 1978. However, this does not mean that everyone who used legal aid services before 2007 was affected.
The compromised information may include names, addresses, dates of birth and details connected to legal aid applications and cases. Depending on the individual record, it may also contain financial or other sensitive personal information. Investigators have additionally confirmed that limited data relating to HM Prison and Probation Service was included in the stolen material. The government stated that this probation data does not relate to victims of crime.
The Ministry of Justice has confirmed that it has no indication that the stolen information has been published or shared. However, the exact information affected varies from person to person, and the presence of a record in the affected period does not automatically mean that an individual’s data was stolen. Officials are continuing to analyse the information to understand who may have been affected. The government has also taken legal action to prevent the unlawful use, disclosure or publication of the stolen data.
Following the incident, the Ministry of Justice and the Legal Aid Agency have been working to strengthen their systems and reduce the risk of similar attacks. Measures include improving authentication and access controls, strengthening security monitoring, addressing vulnerabilities and modernising older technology. People who believe they may be affected are advised to remain alert to suspicious emails, messages and phone calls, verify unexpected requests for sensitive information, and use strong, unique passwords. The investigation highlights the importance of protecting older databases, as they can contain sensitive personal information long after the original records were created.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
