UK Legal Aid Agency Breach Exposed Records Dating to 1978
Summary
A forensic review found that the UK Legal Aid Agency breach compromised records dating to 1978, including personal data of legal aid applicants, practitioners and some probation service users. The agency says it has no evidence the data was released or sold.
Key points
- The breach occurred in April 2025; the agency previously reported that attackers accessed and exfiltrated legal aid applicants’ personal information.
- About 250,000 compromised records predate 2007; the earliest verified record dates to 1978.
- Potentially affected applicant and recipient data includes names, addresses, birth dates, National Insurance Numbers and case details.
- Exfiltrated information also included legal aid practitioners’ contract and payment details and user account credentials.
- Data relating to a relatively small number of probation service users was accessed, including names, birth dates, nationalities and case references.
- The agency says the investigation was complicated by multiple systems and large volumes of fragmented or incomplete data.
- The agency has no evidence that the stolen information has been publicly released or sold.
Article Details
- Victim Organization
- Legal Aid Agency (LAA)
- Incident Type
- Data breach involving unauthorized access to and exfiltration of data
- Incident Date
- 2025-04-01
- Data Types Exposed
- Names
- Addresses
- Dates of birth
- National Insurance Numbers
- Postcodes
- Case reference numbers
- Answers entered into the Client and Cost Management System (CCMS)
- Phone numbers
- Contracts
- Schedules
- Office locations
- Payment details
- User account credentials
- Nationalities
- Affected Records
- Approximately 250,000 compromised records predated 2007. The total number of compromised records was not disclosed.
- Operational Impact
- The breach affected data across multiple systems. The agency said the volume of information and its unstructured, fragmented, or incomplete state made the investigation complex.
- Ransom Or Extortion
- No ransom or extortion activity was reported. The LAA said it had no evidence that the stolen information had been publicly released or sold.
- Claim Status
- confirmed
Products
Countries
Industries
Legal aidThe UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.Probation servicesreference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017,” LAA says.