Hackers behind Legal Aid Agency data breach stole records dating back to 1978
Published: 15/10/2026
| The Register
A forensic review of the April 2025 cyberattack on the Legal Aid Agency (LAA) has revealed the incident was far more extensive than first reported, compromising around 250,000 historical records dating back to 1978.
The newly uncovered material includes historical legal aid benefit assessments from 1978 to 2012 and Very High Cost Cases scheme payments between 1981 and 2004, containing sensitive details such as National Insurance numbers, financial records, and criminal proceedings.
Investigators also discovered an unexpected compromise of HM Prison and Probation Service (HMPPS) records. Hackers accessed names, dates of birth, nationalities, and case reference numbers of offenders supervised between 2010 and 2017, with over 99% relating to 2016 and 2017.
The Ministry of Justice (MoJ) attributed the lengthy timeline for investigating the root causes and extent of the breach to the complex, fragmented nature of legacy systems. While officials have found no evidence that data was published, the government department has tightened access controls, strengthened security monitoring, and accelerated efforts to isolate and modernise obsolete infrastructure.
Training Announcement: The BCS Practitioner Certificate in Information Risk Management (PCIRM) is an advanced-level programme for data specialists who actively monitor and minimise the risk of cyberattacks, information security incidents, and data protection violations. Find out more.
Information Risk Training
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 3,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.