The British Legal Aid Agency (LAA) confirmed that the cyberattack on its systems in April 2025 resulted in the theft of records dating back to 1978, covering a much broader period than initial estimates, which focused on payment data and information about recent users.
The agency, which is part of the British Ministry of Justice, manages public defense services and legal aid funding in England and Wales. It employs approximately 1,250 people and works with around 2,000 service providers, including lawyers, law firms and nonprofit organizations.
Scope of the stolen data
The agency disclosed the breach in early May 2025, warning that legal aid service providers’ payment information might have been compromised. Two weeks later, it confirmed that the incident involved a larger set of sensitive data, most of it dating from 2010 onward.
According to the agency, the affected data includes contact details, dates of birth, national identification numbers, criminal histories and employment status, in addition to contribution, debt and payment amounts. Service-provider data also included contracts, office locations, financial information, contact details and LAA Online Portal credentials, including names and email addresses.
A subsequent analysis of the data extracted from the systems showed that approximately 250,000 records dated from before 2007. The overwhelming majority of these records date from the 1990s and the first decade of the 2000s, while a very small number date from before 1990, and the oldest verified record dates back to 1978.
What does this mean in practice?
The existence of old records does not mean that everyone who applied for or received legal aid or interacted with the justice system before 2007 was affected by the breach. The agency has not yet linked all historical records to specific individuals among the stolen data. However, the breadth of the period increases the sensitivity of the incident because it combines identifying and financial data with information related to cases and criminal records.
The British Ministry of Justice said there is currently no evidence that any personal data believed to have been stolen has been published. It explained that the government had allocated £20 million before the attack to stabilize and update the agency’s digital systems, while new investment in modernizing digital services and strengthening resilience and cybersecurity had exceeded £200 million.
Broader context of attacks on the public sector
The agency’s breach came amid a series of attacks targeting British institutions, including the Co-op, Harrods and Marks & Spencer chains, which were attributed to the DragonForce ransomware operation. This prompted the United Kingdom’s National Cyber Security Centre (NCSC) to publish guidance for British organizations to strengthen their defenses.
The United Kingdom also announced a new cybersecurity strategy in January, backed by more than £210 million, while the British Housing Ombudsman said this week that it was investigating a security incident at a third party that affected its case-management system. These developments show that protecting legacy systems and historical data is an essential part of managing public-sector risk, not merely a matter of technical modernization.