The UK government released a data update on October 14, 2026, regarding a cyber-attack originally identified on April 23, 2025, that compromised Legal Aid Agency digital services. The breach exposed records dating back decades, including personal data from civil and criminal legal aid cases.
Incident Background and Data Scope
The UK government reported that on Wednesday 23 April 2025, an attack hit the Legal Aid Agency's online digital services. By 16 May 2025, officials established that the criminal group had exfiltrated a significant amount of personal data.
While most affected data spans from January 2007 to May 2025, the agency confirmed that about 250,000 records predate 2007. The earliest verified record dates back to 1978.
Affected Individuals and Systems
The breach impacted various groups, including recipients of civil legal aid, police station advice, criminal representation, and Crown Court cases. Information such as names, dates of birth, National Insurance numbers, and financial details may have been compromised depending on the individual.
Additionally, material exfiltrated during the incident contained probation data from the HM Prison and Probation Service involving individuals managed between 2010 and 2017.
Response and Security Measures
The Legal Aid Agency worked alongside the National Crime Agency, the National Cyber Security Centre, and the Information Commission during its response. The agency noted there is no indication that the stolen data has been published or shared.
The Ministry of Justice and Legal Aid Agency undertook work to strengthen authentication and access controls, improve security monitoring, address vulnerabilities, and modernise legacy systems.
What to do
- Remain alert to suspicious messages, emails or telephone calls.
- Be cautious about unexpected requests for personal or financial information.
- Independently verify the identity of anyone asking for sensitive information.
- Ensure that passwords are strong and are not reused across different accounts.
Key facts and where they come from
- The Legal Aid Agency identified a cyber-attack affecting online digital services on Wednesday 23 April 2025.
On Wednesday 23 April 2025, we identified a cyber-attack affecting the Legal Aid Agency’s (LAA) online digital services
- Approximately 250,000 records affected by the attack predate 2007, with the earliest verified record dating from 1978.
approximately 250,000 records predate 2007. The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978.
- The breach also included probation data from the HM Prison and Probation Service.
some information relating to HM Prison and Probation Service (HMPPS), specifically probation data, was contained within material exfiltrated during the same cyber-attack.
- The Legal Aid Agency stated it has no indication that the stolen data has been published or shared.
we have no indication that the stolen data has been published or shared.
