Legal Aid Agency traces records stolen in April 2025 breach back to 1978
UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.
The Watch · Security desk
Approximately 250,000 stolen records predate 2007. The earliest verified record, from 1978, is 32 years older than the 2010 start the agency confirmed in May 2025. The start of the main stolen-data window moved back three years, from 2010 to 2007.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Stolen records predating 2007, approximately | 250,000 records | 7 | |
| 1978 record vs 2010 start | 32 years older | 17 | |
| Main data window moved back | 3 years | 16 |
What happened
- Its update this week says the vast majority of the data relates to applications, claims or payments between January 2007 and 16 May 2025.
- Of the roughly 250,000 older records, the agency says the overwhelming majority date from the 1990s and 2000s, and only a fractionally small number from before 1990.
- Provider data was taken as well, including contracts, office locations, financial information and LAA Online Portal credentials with names and email addresses.
Why it matters
- exposure People who applied for legal aid in the 1990s and 2000s are now inside the breach window, though the agency says pre-2007 contact alone does not mean a person was affected.
- constraint The agency's scope has widened with each statement since early May 2025, so applicants and providers have no basis yet to treat the current window as final.
- cost The remediation bill is public money: the Ministry of Justice now says more than 200 million pounds, at least ten times its pre-attack 20 million pound commitment.
The agency has now given two start dates for the same stolen data. In May 2025 it said the applicant and recipient records it had confirmed ran from 2010 onward [3]. This week it said the vast majority of the data relates to applications, claims or payments between January 2007 and 16 May 2025 [6]. That moves the start of the main window back three years [16]. The agency put the change down to follow-up analysis of the exfiltrated data [11].
The tail is the larger revision. Measured against the 2010 floor, the oldest record is 32 years earlier [17]. The agency said: "The earliest record currently verified dates from 1978." [9] The wording is "currently verified", so 1978 is the earliest date confirmed so far.
The count is of records, not people. The agency said records predating 2007 do not mean everyone who received or applied for legal aid, or interacted with the justice system, before 2007 was affected [10]. The figures show a longer date range and a 250,000-record tail. To call the breach larger overall, we would need a total record count, a headcount, or an attributed actor for the LAA intrusion, and the BleepingComputer report includes none of them.
What an attacker holds is not in dispute. Applicant data includes dates of birth, national ID numbers and criminal history [4]. Provider data includes contracts, office locations, financial information and LAA Online Portal credentials with names and email addresses [5]. The agency works with about 2,000 providers [15]. In our view, a date of birth and a national ID number keep their value for fraud however old the file is, so a 1990s record is as useful to a thief as a recent one.
On publication, the public position comes from one source. A Ministry of Justice spokesperson told BleepingComputer: "There is currently no evidence that any personal data believed to have been exfiltrated has been published." [12]
The retail attacks that followed the LAA breach, on the Co-op, Harrods and Marks & Spencer, were claimed by DragonForce, and the National Cyber Security Centre issued guidance afterward [14].
What to watch
- Whether the agency publishes a total record count or a number of affected individuals, which is what it would take to call the exposure larger overall.
- Whether the earliest verified date moves before 1978, given the agency's own wording is 'currently verified'.
- Whether any LAA data appears on a leak site, against the Ministry of Justice's current position of no evidence of publication.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap−10
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Legal Aid Agency says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
- [2]
The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised.
- [3]
Two weeks after the early May 2025 disclosure, the LAA confirmed the breach was more serious than first believed, after finding attackers had stolen a large trove of applicant and recipient data from 2010 onward.
- [4]
The stolen applicant and recipient data includes contact details, dates of birth, national ID numbers, criminal history, employment status, contribution amounts, debts and payments.
- [5]
The attackers also stole legal aid providers' data, including provider contracts, office locations, financial information, contact details and LAA Online Portal credentials (including names and email addresses).
- [6]
The LAA said: "The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period."
- [7]
The LAA said: "However, we have now confirmed that approximately 250,000 records predate 2007."
- [8]
The LAA said: "The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990."
- [9]
The LAA said: "The earliest record currently verified dates from 1978."
- [10]
The LAA noted that records predating 2007 do not mean everyone who received or applied for legal aid, or interacted with the justice system, before 2007 was affected.
- [11]
In an update published this week, the LAA said follow-up analysis of the exfiltrated data found that the stolen records go back almost five decades.
- [12]
A Ministry of Justice spokesperson told BleepingComputer: "There is currently no evidence that any personal data believed to have been exfiltrated has been published."
- [13]
The Ministry of Justice spokesperson said that before the cyber-attack the ministry had committed 20 million pounds to stabilising and upgrading the Legal Aid Agency's digital systems, and is now investing more than 200 million pounds in modernising digital services, improving resilience and strengthening cyber security across legal aid services.
- [14]
The LAA breach was followed by a string of cyberattacks on the Co-op, Harrods and Marks & Spencer retail chains claimed by the DragonForce ransomware operation, and the National Cyber Security Centre published guidance advising UK organizations to strengthen their defenses.
- [15]
The LAA works with approximately 2,000 providers, including barristers, solicitor firms and non-profit organizations, and employs around 1,250 staff.
- [16]
The start of the main stolen-data window moved back three years, from 2010 to 2007.
- [17]
The earliest verified record (1978) is 32 years older than the 2010 start the agency confirmed in May 2025.
- [18]
The Ministry of Justice's current investment figure (more than 200 million pounds) is at least ten times its pre-attack commitment (20 million pounds).
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comUK Legal Aid Agency: Hackers stole records dating back to 1978
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- UK public-sector cybersecurityFollow
- Data BreachesFollow
Entities
- Legal Aid AgencyFollow
- Ministry of Justice (England and Wales)Follow
- BleepingComputerFollow
- National Cyber Security CentreFollow
- DragonForceFollow