Details of the data stolen in the Legal Aid Agency (LAA) cyber attack in May 2025 have been published confirming 250,000 pre-2007 records were also compromised.
Following the attack on 23rd April 2025, the Legal Aid Agency’s online portal was taken offline. In May the agency confirmed the hack had been more extensive than previously thought with personal information relating to legal aid applicants and providers stolen.
In data published by the LAA and in a written statement Sarah Sackman, minister of state for courts and legal services it was confirmed not only was data between 2007 and 16 May 2025 compromised, but a “small proportion of records” dating back as far as 1978 were also access. The extent of the data stolen differs from person to person said Sackman, but may include “basic personal details such as names, addresses and dates of birth, as well as information relating to legal aid applications and cases, including in some instances financial or other sensitive personal information.”
The extensive and detailed digital analysis has also uncovered information relating to HM Prison and Probation Service (HMPPS), specifically limited probation data, was also accessed, although there is no evidence information about victims of crimes was included.
The full details of “the groups potentially affected and the types of data that may have been exfiltrated” has been published online with the LAA highlighting “the presence of records predating 2007 does not mean that everyone who received or applied for legal aid, or otherwise interacted with the justice system before 2007, has been affected.”
In her statement Sackman continued: “The MoJ is working at pace and will, where data allows, be able to identify whether any specific individual’s data was exfiltrated in the cyber-attack.
“We are updating the public information on GOV.UK alongside this statement, to provide more detailed information to help individuals understand the data that was exfiltrated. It is important to remember that much of the exfiltrated information was unstructured, fragmented, and incomplete, meaning that, in many instances, the identification of specific individuals will not be straightforward for the criminals who stole it.
Some £200 million has been allocated to “transformation, recovery, and moving legacy systems to a modern and safe technology platform” in the LAA. “The Department’s objective,” continued Sackman “is not simply to recover from the attack, but to emerge stronger, more resilient, and better prepared for the future.
The minister concluded there was “indication that the stolen data has been published or shared.”
Legal Aid Agency cyber security incident data update October 2026
