UK Legal Aid Agency Breach Exposes 50 Years of Sensitive Data
A cyberattack on the UK Legal Aid Agency exposed data from 1978 to 2025.
Why it matters: Legal professionals must reassess data security in legal aid and criminal justice systems amid this extensive breach. It also raises compliance and regulatory issues around protecting sensitive government-held information.
- The breach was identified on April 23, 2025, impacting the Legal Aid Agency's online services.
- Approximately 250,000 records predating 2007 were compromised, with data going back to 1978.
- Compromised data included personal details and sensitive information from HM Prison and Probation Service probation records.
- As of October 14, 2026, there is no evidence the stolen data has been published or shared.
On April 23, 2025, the UK Legal Aid Agency (LAA) detected a cyberattack on its online digital services, exposing a vast amount of sensitive information. Initial statements indicated that data from 2007 onward was compromised. However, further investigation revealed that around 250,000 records dated before 2007 were also taken, with the earliest confirmed record originating in 1978. The UK government update in October 2026 detailed the extensive historical scope of the breach.
The compromised data includes names, addresses, dates of birth, national identification numbers, criminal histories, employment status, and financial details. Notably, the incident also involved the exfiltration of probation data linked to the HM Prison and Probation Service (HMPPS), underscoring the sensitivity and breadth of the information accessed. The official Legal Aid Agency statement highlighted the variety of personal and legal information affected.
Courts and Legal Services Minister Sarah Sackman commented that criminals exploited vulnerabilities in the LAA's IT systems to gain unauthorized access, pointing to weaknesses in legacy systems and cybersecurity practices. This breach puts a spotlight on the urgent need for ongoing security updates and stronger protections, especially for government agencies managing confidential data.
As of mid-October 2026, authorities have not found any signs that the stolen data has been published or shared publicly. However, the incident raises important questions about risk management, regulatory compliance, and the safeguarding of legal aid and criminal justice data in the UK.
By the numbers:
- 250,000 records — compromised predating 2007
- 1978 — earliest verified record affected by the breach
- April 23, 2025 — date the cyberattack was identified