The 2025 cyber-attack on the Legal Aid Agency took older records than the government first said. In an update published on 14 October 2026, the agency said the earliest affected record dates from 1978.
According to the security bulletin site Cypro, which summarised the update, about 250,000 of the exfiltrated records predate 2007. The Ministry of Justice had earlier said the breach involved applicants from 2007 onward.
What the update says
The Legal Aid Agency (LAA) is an executive agency of the Ministry of Justice. It runs legal aid in England and Wales. Its online services let providers submit applications, manage cases and claim payment.
Cypro reports that the October 2026 update replaces earlier assessments. Most of the affected material still relates to applications, claims or payments made between January 2007 and 16 May 2025, or to cases that were live in that period. Closer analysis then found the pre-2007 records.
The update also says limited probation data was involved, according to Cypro. Earlier disclosures had already said that a “significant amount of personal data” about applicants had been accessed and downloaded, including criminal records, as the news aggregator inkl reported.
The government’s account, as summarised by those outlets, is that criminals exploited vulnerabilities in LAA IT systems, reached systems holding personal information and took data. Public statements have not named the attackers or described the method in detail.
How the story has moved
The Solicitors Journal reports that the LAA detected the attack on 23 April 2025. Online services were disrupted. Legal aid providers were told some of their financial information might have been exposed. The National Crime Agency and the National Cyber Security Centre were brought in.
Later reporting, based on the agency’s annual report, found that systems had been compromised in December 2024 and that data theft began in January 2025, according to Cypro. That would mean the intruders were inside for months before anyone noticed.
Several systems were taken offline during the response, including the Client and Cost Management System, Controlled Work Administration, Crime Apply and Secure File Exchange. Cypro says phased restoration of crime and civil services began in October 2025.
The new figures arrive more than a year after the incident. They show how slowly the true scope of a breach can emerge when an organisation holds decades of data in old systems.
What affected people can do
The sources do not say how individuals will be notified, and readers should check the official GOV.UK update for the agency’s current guidance. Until then, some sensible steps apply to anyone who has ever applied for legal aid, or worked as a provider.
- Expect phishing. Messages that mention your case, solicitor or a payment may use stolen details to look genuine. Do not click links or open attachments you did not expect.
- Verify by another route. If someone claiming to be the LAA, a court or a law firm asks for money or personal details, hang up and use a phone number from an official website.
- Protect your accounts. Use unique passwords and turn on two-step verification for email and banking.
- Watch your credit file. Check it for applications you did not make. Consider a free fraud alert or credit report from a UK credit reference agency.
- Providers should be careful with payment changes. Confirm any request to change bank details with a known contact before paying.
Records of this kind can include sensitive details such as criminal history and financial circumstances. That makes them useful for pressure and impersonation scams, not just for ordinary fraud.
Those with questions about whether their data was involved should contact the Legal Aid Agency through the details on its official GOV.UK pages.