UK Legal Aid Agency Cyberattack Exposed Records Dating Back to 1978

The Legal Aid Agency (LAA), the executive arm of the UK Ministry of Justice that manages the country’s public defender service, says attackers who infiltrated its IT systems in April 2025 stole records dating back to 1978.

The LAA employs around 1,250 people, oversees billions in legal funding and works with approximately 2,000 providers, including solicitors, law firms and not-for-profit organizations that deliver civil and criminal legal aid services in England and Wales.

Legal Aid Agency data breach expanded after further analysis

The LAA disclosed the cyberattack in early May 2025, initially warning that payment information belonging to legal aid providers may have been compromised.

Two weeks later, the agency said attackers had stolen a significant amount of sensitive data dating back to 2010. The information included contact details, dates of birth, national ID numbers, criminal records, employment status, contributions, debts and payments.

The disclosure confirmed that the Legal Aid Agency data breach was more serious than initially believed.

Threat actors also stole information belonging to legal aid providers, including provider contracts, office locations, financial information, contact details and credentials for the LAA’s online portal, including names and email addresses.

In an update released this week, the LAA said further analysis of the stolen data showed that some records date back nearly 50 years.

“The majority of the LAA data relates to applications, claims, and payments filed with the LAA from January 2007 to May 16, 2025, or cases that were ongoing during this period. However, we have now identified approximately 250,000 records that predate 2007.” the agency said.

“The vast majority of these are from the 1990s and 2000s, with only a few before 1990. The oldest known record to date is from 1978.”

However, the LAA stressed that the existence of a pre-2007 record does not mean everyone who received legal aid, applied for it or interacted with the justice system before 2007 was affected.

Ministry of Justice says no evidence data was published

“We recognize that incidents of this nature are concerning for everyone affected, which is why we have published information about the UK government as quickly as possible and have continued to update it as our understanding of cyber-attacks develops,” a Ministry of Justice spokesperson told BleepingComputer.

“Prior to the cyber-attack, we had already invested £20 million to stabilize and upgrade the Legal Aid Agency’s digital systems. We are currently investing more than £200 million to modernize our digital services, improve resilience and strengthen cybersecurity across our legal aid services. At this time, there is no evidence that any of the personal data we believe to have been compromised has been made public.”

UK public sector faces continued cyberattack threat

The LAA breach was followed by cyberattacks targeting UK retail chains Co-op, Harrods and Marks & Spencer (M&S). The attacks were claimed to be linked to Operation DragonForce ransomware.

In response, the UK’s National Cyber Security Centre (NCSC) issued guidance urging UK organizations to follow recommended measures and strengthen their cybersecurity defenses.

In January, the UK also announced a new cybersecurity strategy backed by more than £210 million ($283 million) to strengthen cyber defenses across the government and public sector.

The UK Housing Ombudsman Service, a non-departmental public body sponsored by the Department for Housing that resolves disputes between council housing residents and council landlords in England, also revealed this week that it was investigating a third-party IT security incident affecting its incident management system.

Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, correct and revalidate at machine speed.

Reserve your seat