A data breach at the UK Legal Aid Agency (LAA), the United Kingdom’s Public Defender service, has exposed providers’ corporate details and applicants’ personal information, some dating back to the 1970s.
LAA first disclosed the cyberattack in May 2025, but could not determine whether personal information was leaked. At the time, it warned that a third party might have accessed financial information relating to legal aid providers. However, a subsequent investigation found the breach was worse than anticipated and that the threat actors had accessed sensitive applicant data before 2010.
The breach exposed contact details, dates of birth, national ID numbers, criminal history, employment status, contribution amounts, debts, and payments. Similarly, the breach exposed Legal Aid providers’ contracts, office locations, financial information, contact details, and LAA Online Portal credentials.
However, the exposed data varied by individual, and the UK Legal Aid Agency has no evidence that the stolen information was published online.
UK Legal Aid data breach dates back to the 1970s
An update published on October 14, 2026, said a subsequent extensive investigation found that the data breach was more extensive than initially believed, exposing data from before 2010.
“The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007,” the agency disclosed.
However, the agency said that the data breach did not impact everyone who sought legal aid or interacted with the justice system before 2007. While most records dated from the 1990s to the 2000s, with a small fraction predating 1990, the agency also discovered a record dating back to 1978.
“The earliest record currently verified dates from 1978,” the agency stated.
According to Findlay Whitelaw, Cybersecurity Strategist & Researcher at Exabeam, the data breach reminds us that information stays “sensitive long after the case it was collected for has closed.”
“Approximately 250,000 affected records predate 2007, with the earliest verified record dating from 1978. Let’s be clear, that does not mean everyone who used legal aid during that period was affected. But information such as a date of birth, National Insurance number or criminal history cannot simply be reset like a password,” noted Whitelaw.
UK Legal Aid Agency data breach exposed criminal data
The LAA data breach exposed information relating to HM Prison and Probation Service (HMPPS), but excluded victims’ information.
“Our improved cyber capabilities have also identified that data relating to probation service users was also accessed,” the agency stated.
It exposed the names, dates of birth, nationalities, and case numbers for offenders managed by Probation Services between 2010 and 2017.
UK Legal Aid published a table detailing the type of data leaked for each category. For example, the data breach exposed the surnames and initials, postcodes, case dates, claimed costs and VAT, and the locations of courts, prisons, or police stations associated with individuals who received police station legal advice.
Meanwhile, the UK Legal Aid Agency has said analyzing the stolen data was challenging because the breach affected numerous complex digital systems and the leaked information was incomplete or fragmented.
“The agency says its understanding changed as teams analyzed fragmented and incomplete data,” said Andrew Costis, Engineering Manager of the Adversary Research Team at AttackIQ. “Establishing more precisely what was taken can take far longer than securing the systems. Recovery and modernization are also opportunities to check access to older records. Continuous exposure management can help teams track those access paths and prioritize any gaps they find.”
LAA says it has worked painstakingly to understand the nature of the stolen information, made possible by its improved data analysis capabilities. The agency had previously invested £20 million ($27 million) to upgrade its digital system and plans to invest £200 million ($266.2 million) in further modernization and cybersecurity resilience.
So far, the threat actor’s identity remains unknown. However, the UK MP and Minister of State for Courts and Legal Services, Sarah Sackman, told the House of Commons that the threat actor exploited vulnerabilities in the LAA’s IT systems to gain access and exfiltrate the sensitive personal information.
The UK Legal Aid Agency has advised affected individuals to watch for potential phishing scams, including from people who appear to know private information about their lives.
LAA has advised impacted victims to remain alert for suspicious phone calls and text and email messages. The UK agency also recommended being on the lookout for people demanding sensitive personal information, including credit cards and account passwords.
