LAA Forensics Confirm Hack Stole NI Numbers, Credentials and Probation Files Dating to 1978

The UK Legal Aid Agency (LAA) has expanded the known scope of its April 2025 data breach after a forensic review revealed that stolen records date back to 1978. According to SecurityWeek, the agency published an update this week detailing the full extent of the compromise, which was first disclosed in May 2025.

While the LAA initially reported that hackers accessed personal information of legal aid applicants, the new findings show that the majority of compromised data relates to applications, claims, and payments submitted between 2007 and 2025. However, investigators confirmed that roughly 250,000 records predate 2007. The agency stated that the overwhelming majority of these older records originate from the 1990s and 2000s, with only a small fraction dating before 1990. The earliest verified record currently identified traces back to 1978.

Investigation Complexity and Data Types

The LAA explained that the investigation took considerable time because the attack involved multiple systems and significant volumes of unstructured, fragmented, or incomplete data. This complexity required specialist technical and data teams to undertake extensive analysis to determine exactly what information attackers accessed and exfiltrated. Compromised data for applicants and recipients includes names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, phone numbers, and answers entered into the Client and Cost Management System (CCMS).

Affected Parties and Probation Records

The breach also affected legal aid practitioners who interacted with the LAA, exposing contracts, schedules, office locations, payment details, and user account credentials. Other impacted groups include judges, solicitors, advocates, parties in civil certificated proceedings, and individuals managing pay point locations. Additionally, the agency identified that data relating to probation service users was accessed. This includes names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders actively managed by Probation Services between 2010 and 2017.

What should you do?

The LAA stated that it has no evidence that the stolen information has been released publicly or sold. That suggests the immediate risk of widespread identity theft may be lower, but the presence of user credentials and National Insurance Numbers remains a significant concern for affected individuals. SecurityWeek reported that the agency did not share the full scope of the incident in its initial May 2025 announcement, leading to this expanded disclosure.

What to do and how to stay safe: Legal Aid Agency

• Monitor credit reports and bank statements for unauthorized activity, as National Insurance Numbers and financial details were compromised.
• Change passwords for any accounts linked to the affected systems, especially if you are a legal practitioner or have used similar credentials elsewhere.
• Enable multi-factor authentication on all sensitive accounts to reduce the risk of credential stuffing attacks.
• Watch for phishing attempts that reference legal aid cases or probation matters, as attackers may use stolen data for social engineering.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How far back do the compromised records date?

The earliest verified record dates from 1978, with approximately 250,000 records predating 2007, mostly from the 1990s and 2000s.

What specific types of personal data were stolen?

Stolen data includes names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, and user account credentials.

Has the stolen data been sold or published online?

The Legal Aid Agency stated it has no evidence that the stolen information has been released publicly or sold.