- Approximately 250,000 compromised Legal Aid Agency records predate 2007, with the earliest verified record dating from 1978.
- Probation data in the exfiltrated material included some personal and case information for a relatively small number of offenders managed between 2010 and 2017.
- The agency said it has no indication that the exfiltrated data has been published or shared.
The Legal Aid Agency confirmed that approximately 250,000 records dating from before 2007 were exfiltrated in the cyberattack it identified on Apr 23, 2025. The agency also confirmed that probation data was included in the material taken during the incident.
The probation data included some names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed between 2010 and 2017. More than 99 percent of that data related to offenders under supervision in 2016 and 2017, and none related to crime victims.
The affected systems support legal aid services. Infosecurity Magazine said the agency provides citizens with access to civil and criminal legal services. The agency said the vast majority of affected data related to applications, claims, payments or live cases from January 2007 through May 16, 2025, while the earliest verified record dates from 1978.
On this page
The attack involved multiple complex systems
The Legal Aid Agency said the attack affected complex digital systems and significant volumes of information. Much of the data was unstructured, fragmented or incomplete.
The agency established on May 16, 2025, that the attack was more extensive than first understood and that a criminal group had accessed and exfiltrated a significant amount of personal data.
Legal aid records could contain financial and identity details
The affected legal aid information varies between cases. It can include full names, dates of birth, National Insurance numbers, postcodes, equality monitoring codes, case dates, claimed costs and VAT amounts.
Information relating to legal aid providers may include contracts, schedules, office locations, payment details, financial account information, bank account names, account numbers and sort codes.
The ministry is working with three agencies
The Register said the Ministry of Justice had discovered that hackers accessed HM Prison and Probation Service information, including names, dates of birth, nationalities and case reference numbers for offenders supervised by probation services between 2010 and 2017.
The Record said the hackers claimed to hold data on more than 2 million people and threatened to release it unless they received payment. It also said the British government has a longstanding policy of refusing to pay extortion demands.
The Legal Aid Agency said it has no indication that the exfiltrated data has been published or shared. It said earlier public statements reflected the best information available at the time.
The Ministry of Justice continues working with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office.
What to do now
- Ensure that passwords are strong and are not reused across different accounts.
FAQ
What happened in the Legal Aid Agency cyberattack?
The agency identified an attack on Apr 23, 2025, and later confirmed that approximately 250,000 pre-2007 records and probation data were exfiltrated.
Who was affected by the Legal Aid Agency data incident?
Affected information related mainly to legal aid applications, claims, payments and live cases. The material also included probation data for a relatively small number of offenders managed between 2010 and 2017.
Was the Legal Aid Agency data published?
The agency said it has no indication that the exfiltrated data has been published or shared.
What information was in the probation data?
The probation data included some names, dates of birth, nationalities and case reference numbers. More than 99 percent concerned offenders supervised during 2016 and 2017.
Sources
- Legal Aid Agency cyber security incident data update October 2026, Legal Aid AgencyPrimary
- UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978, The Record
- UK Legal Aid Agency Hack Scope Widens After Forensic Review, SecurityWeek
- Legal Aid Agency hackers made off with records dating back to 1978, The Register
- Legal Aid Agency Admits Major Breach of Applicant Data, Legal Aid Agency
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Legal Aid Agency identified a cyberattack affecting its online digital services on 23 April 2025. | Legal Aid Agency | Confirmed |
| The agency established on 16 May 2025 that the attack was more extensive than originally understood and that significant personal data had been exfiltrated. | Legal Aid Agency | Confirmed |
| The vast majority of affected Legal Aid Agency data relates to applications, claims, payments or live cases from January 2007 through 16 May 2025. | Legal Aid Agency | Confirmed |
| The agency confirmed that approximately 250,000 compromised records predate 2007, with the earliest verified record dating from 1978. | Legal Aid Agency | Confirmed |
| The exfiltrated material included some probation data, but none of that data related to crime victims. | Legal Aid Agency | Confirmed |
| Probation data included some names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders managed between 2010 and 2017. | Legal Aid Agency | Confirmed |
| More than 99 percent of the affected probation data concerned offenders supervised during 2016 and 2017. | Legal Aid Agency | Confirmed |
| The agency said it has no indication that the stolen data has been published or shared. | Legal Aid Agency | Confirmed |
| The agency said the attack affected complex digital systems and significant volumes of unstructured, fragmented or incomplete information. | Legal Aid Agency | Confirmed |
| The agency recommends remaining alert to suspicious messages, emails or telephone calls and verifying unexpected requests for personal or financial information independently. | Legal Aid Agency | Confirmed |
| Infosecurity Magazine said the Legal Aid Agency provides citizens with access to civil and criminal legal services. | Infosecurity Magazine | Attributed |
| The Record said the hackers claimed to hold data on more than 2 million people and threatened to release it unless they were paid. | The Record | Attributed |
| The Record said the British government has a longstanding policy of refusing to pay extortion demands. | The Record | Attributed |
| The Record said justice Minister Sarah Sackman described the incident as significant and complex in a written statement to Parliament. | The Record | Attributed |
| Sarah Sackman said criminals exploited vulnerabilities in the agency’s IT systems to access systems containing personal information and exfiltrate data. | Sarah Sackman, via The Record | Attributed |
| Legal Aid Agency said the agency said exfiltrated information varies between cases and can include full names, dates of birth, National Insurance numbers, postcodes, equality codes and payment details. | Legal Aid Agency, via The Record | Attributed |
| The Record said the stolen material included judges, defence and prosecution lawyers, court reporters and opposing parties in some civil cases. | The Record | Attributed |
| Legal Aid Agency said the agency said earlier public statements reflected the best information available at the time. | Legal Aid Agency, via The Record | Attributed |
| The Record said charities warned that the stolen data could contain sensitive information about women and girls who survived domestic abuse. | The Record | Attributed |
| The ministry continues working with the National Crime Agency, National Cyber Security Centre and Information Commissioner’s Office. | Ministry of Justice, via The Record | Attributed |
| gov.uk published its report on Oct 14, 2026. | gov.uk | Confirmed |
Could not verify
- Whether the attackers exploited a specific vulnerability or used a particular intrusion method is not established
- Whether the stolen information was published or shared is not established beyond the agency’s statement that it has no indication of this
- How many individuals were affected is not established; approximately 250,000 refers to records, not confirmed people
- Whether the attack was conducted by a named group or extortionists is not established
Related stories
Data LeaksDodo Pizza attack leads to detention of three suspected DataSuckers
AI-Powered AttacksFake AI campaigns linked to 1,258 analyses by ANY.RUN
Vulns & PatchesFortiOS flaw CVE-2025-61624 exploited to deploy PEERSTITCH