UK Legal Aid Breach Stretched Back to 1978, Probation Records Also Taken

Breach reached back to 1978

Hackers who broke into the UK Legal Aid Agency in April 2025 stole records dating back nearly five decades, the government has admitted, with one record going back to 1978. The agency said that around 250,000 of the stolen records date from before 2007, far further back than its initial estimate that the data covered legal aid applications, claims and payments from 2007 onward.

Most of the newly identified records date from the 1990s and 2000s, with only a fractionally small number originating before 1990. Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004.

Probation data also accessed

The Ministry of Justice also discovered that the attackers accessed information from HM Prison and Probation Service, including names, dates of birth, nationalities and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government said the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime.

Months of disruption and delays

The Legal Aid Agency detected the intrusion on April 23, 2025, but did not establish the scale of the compromise until May 16. Officials subsequently took the agency's online services offline, leaving lawyers struggling to submit claims and manage cases. The disruption dragged on for months, and the agency's troubled return to service in December left legal aid providers battling delays and ongoing technical problems.

Forensic work and remediation

The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions and sentences. The Ministry of Justice said the stolen information was spread across several complex systems, much of it unstructured, fragmented or incomplete, which slowed efforts to establish the extent of the theft. The government cautioned that the presence of historical records does not mean everyone who applied for legal aid before 2007 was affected, and that the 250,000 figure is not a confirmed number of affected individuals.

The government says it has no indication that the stolen information has been published or shared. Since the attack, the Ministry of Justice says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology, with work to modernize its legacy systems also underway. The latest update does not answer why records stretching back to the 1970s remained accessible in the first place.

Sources: The Register