UK Legal Aid Agency Confirms Hackers Stole Records Dating Back to 1978
Attackers breached the UK Legal Aid Agency in April 2025, stealing sensitive data from applicants and providers spanning nearly five decades.
Key points
- The Legal Aid Agency confirmed attackers exfiltrated records dating back to 1978 following an April 2025 breach.
- Approximately 250,000 records predate 2007, with the vast majority originating from the 1990s and 2000s.
- Stolen data includes personal identifiers, criminal histories, financial details, and provider portal credentials.
The UK Legal Aid Agency confirmed that cyber attackers stole records dating back to 1978 after breaching its IT systems in April 2025. This disclosure expands the scope of the incident significantly beyond the initial reports of compromised payment information for legal aid providers.
According to BleepingComputer, the agency’s follow-up analysis revealed that approximately 250,000 records predate 2007. While the vast majority of stolen data relates to applications and payments between January 2007 and May 16, 2025, the oldest verified record originates from 1978. Most older records are from the 1990s and 2000s.
Scope of the Data Breach
The breach exposed a wide array of sensitive information belonging to both applicants and service providers. For individuals, the stolen data includes contact details, dates of birth, national ID numbers, and criminal history. It also contains employment status, contribution amounts, debts, and payment records.
Attackers also compromised data belonging to the roughly 2,000 providers that deliver civil and criminal legal aid services. This includes provider contracts, office locations, financial information, and contact details. Crucially, the thieves obtained LAA Online Portal credentials, which include names and email addresses for these organizations.
Agency Response and Context
The Legal Aid Agency, an executive agency of the UK Ministry of Justice, manages the Public Defender Service. It employs around 1,250 staff and oversees billions in legal funding. The agency first disclosed the cyberattack in early May 2025, initially warning that payment information might be compromised.
Two weeks later, the agency confirmed the breach was more serious than first believed. A Ministry of Justice spokesperson told BleepingComputer that the government had already committed £20 million to stabilizing and upgrading the agency’s digital systems prior to the attack. The spokesperson emphasized that updates were published on GOV.UK as understanding developed.
What should you do
What to do and how to stay safe
- Urgency and secrecy are the primary psychological triggers used to bypass rational decision-making processes.
- Technical indicators like spoofed addresses are often invisible without specific tooling, so behavioral context matters more.
- Verification must occur through a pre-established out-of-band channel, not the one currently in use.
Trust but verify is the only reliable defense against social engineering. Always confirm urgent requests through a separate, pre-established communication channel.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
