Personal information stolen during a cyberattack on the UK’s Legal Aid Agency (LAA) is considerably older than previously disclosed, with investigators confirming that some compromised records date back nearly five decades. The discovery expands the known scope of a breach first detected in April 2025.
In an update published on October 14, 2026, the Ministry of Justice revealed that approximately 250,000 stolen records predate 2007. Most originate from the 1990s and 2000s, while a much smaller number date from earlier decades. The oldest verified record is from 1978.
The LAA provides legal aid services in England and Wales, helping eligible people obtain legal advice and representation. Its systems hold information about applicants, legal proceedings, payments and financial assessments, making them a potentially valuable target for cybercriminals.
The attack was discovered on April 23, 2025, when criminals exploited vulnerabilities in the agency’s IT infrastructure. Further investigations established that attackers had accessed and downloaded substantial amounts of information, prompting the agency to take affected online services offline in May.
Depending on the individual, stolen records may contain names, addresses, dates of birth, National Insurance numbers, financial information and details of legal cases. Some records also include information about criminal proceedings, benefit assessments and payments to legal representatives.
Investigators additionally identified a limited amount of data belonging to HM Prison and Probation Service among the stolen material. According to the government, this information does not concern victims of crime.
Officials emphasized that the discovery of older records does not mean everyone who received legal aid during those years was affected. The stolen material is often incomplete or fragmented, and the amount of information exposed varies considerably between individuals. No complete legal aid case records were taken, according to the Ministry of Justice.
The government also stated that it has found no indication that the stolen information has been published or shared. However, the investigation continues, and authorities are working to identify affected individuals where the available records allow.
Following the breach, the Ministry of Justice allocated £200 million toward recovery, security improvements and modernization of outdated systems. Measures include stronger access controls, improved monitoring and replacing or isolating vulnerable technology.
People who previously used legal aid services are encouraged to remain alert to suspicious emails, calls and requests for personal information. Anyone concerned about their records can consult the government’s updated breach guidance or contact the Legal Aid Agency directly.