UK Legal Aid Agency: Stolen records reach all the way back to 1978

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that runs the country's Public Defender Service, says the attackers who breached its IT systems in April 2025 stole records dating back to 1978.

The agency employs roughly 1,250 staff, oversees billions of pounds in legal funding, and works with around 2,000 providers — barristers, solicitor firms, and non-profits delivering civil and criminal legal aid across England and Wales.

A breach that kept growing

The LAA first disclosed the attack in early May 2025, warning that provider payment information might have been compromised. Two weeks later the picture darkened: attackers had exfiltrated a large trove of sensitive applicant and recipient data from 2010 onward — contact details, dates of birth, national ID numbers, criminal and employment history, plus contribution amounts, debts, and payments. Provider data was hit too, including contracts, office locations, financial details, and LAA Online Portal credentials.

Records older than expected

In an update this week, the LAA said follow-up analysis pushed the timeline back nearly five decades. The bulk of the data concerns applications, claims, or payments filed between January 2007 and 16 May 2025. But roughly 250,000 records predate 2007 — the overwhelming majority from the 1990s and 2000s, with only a fractionally small number from before 1990. The earliest verified record dates from 1978.

The agency stressed that the existence of pre-2007 records does not mean everyone who applied for legal aid or interacted with the justice system before that date was affected.

A Ministry of Justice spokesperson said information had been published on GOV.UK as quickly as possible. Before the attack, £20 million had already been committed to stabilising and upgrading the LAA's digital systems; the department is now investing more than £200 million in modernising services and strengthening cyber security. There is currently no evidence that any of the exfiltrated personal data has been published.

The LAA breach preceded a string of attacks on UK retailers Co-op, Harrods, and Marks & Spencer, claimed by the DragonForce ransomware operation. In January, the UK unveiled a new cybersecurity strategy backed by more than £210 million. And this week the UK Housing Ombudsman Service disclosed that it, too, is investigating a third-party security incident affecting its case management system.

Source: Bleeping Computer