UK Legal Aid Agency Hack Scope Widens After Forensic Review

The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.

In May last year , the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not the full scope of the incident.

An incident update published this week reveals that most of the compromised records are related to applications, claims, and payments submitted between 2007 and 2025.

However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.

“The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978,” the update reads.

Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.

The hackers also exfiltrated data pertaining to legal aid practitioners who interacted with LAA, including contracts, schedules, office locations, payment details, and user account credentials.

Other affected individuals include judges, solicitors, advocates, other parties in civil certificated proceedings, and individuals who managed pay point locations.

“Our improved cyber capabilities have also identified that data relating to probation service users was also accessed. The data exfiltrated by the attackers includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017,” LAA says.

According to the agency, its investigation into the incident took a long time because the attack involved multiple systems and significant volumes of information, most of which was unstructured, fragmented, or incomplete data.

“This has made analyzing the data complex. Therefore, since the incident, specialist technical and data teams have undertaken extensive work to understand what information the attackers accessed and exfiltrated,” the agency said.

LAA also underlined that it has no evidence that the stolen information has been released publicly or sold.

Related: CenterPoint Energy Data Breach Impacts 1 Million Texans

Related: iRhythm Data Breach Impacts at Least 360,000 People

Related: ASOS Confirms Cyberattack, Data Breach

Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

CenterPoint Energy Data Breach Impacts 1 Million Texans

Personal information such as names, addresses, Social Security numbers, and driver’s license numbers was compromised.

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services.

iRhythm Data Breach Impacts at Least 360,000 People

Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.

Oracle Health Data Breach Tally Climbs to Nearly 20 Million

The figure is far higher than the counts that surfaced in earlier filings and patient notifications.

Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts

Southern Company is notifying customers that their utility account information was accessed by hackers.

Advantest Discloses Data Breach Months After Ransomware Attack

The Japanese chip testing giant said hackers stole personal information from its servers in the February 2026 cyberattack.

ASOS Confirms Cyberattack, Data Breach

Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users.

Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System

The Arizona Supreme Court said the information was copied for people dating back as far as 30 years.