Eighteen months after the attack, the Legal Aid Agency says its forensic analysis shows that about 250,000 of the stolen records predate 2007, the oldest from 1978. The work also found probation data among the files the attackers took, which widens a breach that was already one of the most sensitive in recent UK public sector history.
What happened
On 14 October 2026 the Legal Aid Agency (LAA) published an update on GOV.UK about the cyber attack it found on 23 April 2025. This is a follow-up to a known incident, but the new facts matter. Until now the public account had focused on applications, claims and payments from roughly 2007 to May 2025. The LAA now says that around 250,000 exfiltrated records come from before 2007. Most date from the 1990s and 2000s, a very small number predate 1990, and the earliest the agency has verified so far is from 1978.
The update also confirms that the stolen material included data from HM Prison and Probation Service (HMPPS). For a relatively small number of offenders supervised by the Probation Service between 2010 and 2017, the attackers obtained identity details: name, birth date, nationality and case reference. More than 99% of that probation data relates to 2016 and 2017. The LAA stresses that none of it concerns victims of crime.
The agency says it still has no indication that the data has been published or shared. Courts minister Sarah Sackman, in a written statement to Parliament that day, said £200m had been allocated for transformation, recovery and moving legacy systems onto a modern platform. According to DataBreaches.net, the ShinyHunters group claimed responsibility for the attack and the government obtained an injunction against publication. The government has said it could not verify the group’s claims.
The detail
The LAA is frank about why the picture changed. The attack touched several complex systems, and much of the stolen data was unstructured, fragmented or incomplete, so working out what left the building took specialist teams many months.
The new notice breaks down the affected groups in far more detail than before. Some of the most striking entries:
- Benefit status assessments for civil legal aid applicants on passported benefits, covering 1978 to 2012. Fields can include the recipient’s name, birth date, address and National Insurance number.
- Payment records for Very High Cost Cases in criminal legal aid from 1981 to 2004, naming the client, the solicitor or advocate paid and the amounts.
- Crown Court records for trials in two windows (August 2010 to August 2017, and July 2018 to January 2025). These may show offences charged, plea, verdict and sentence.
- Answers entered into the Client and Cost Management System (CCMS) for civil cases between March and May 2025, which can include detailed financial and merits assessments and information about partners and family members.
- Payments made to the LAA between April 2019 and December 2025, in some cases with partially redacted card details.
Beyond clients, the notice lists judges, defence and prosecution advocates and court reporters named in Crown Court records, opponents in civil cases, and people who managed pay point locations.
Why it matters for UK organisations
The headline lesson is about retention. Records nearly half a century old were still somewhere an attacker could reach them. UK GDPR’s storage limitation principle exists precisely because data you no longer need can still hurt people once it leaks.
The second lesson is about scoping. An organisation that cannot quickly tell what was taken cannot tell the right people, and the people affected cannot protect themselves. Here, eighteen months passed before the date range settled, and probation data emerged as an extra category. The UK GDPR requires notification to the regulator within 72 hours where feasible. That deadline is far easier to meet honestly when data is catalogued, structured and kept where you expect it to be.
Finally, the data is highly sensitive. Criminal case outcomes, financial means assessments and family circumstances are just the material for convincing fraud, coercion or targeted harassment. Legal aid clients are often vulnerable.
Expert view
In my experience, the systems that cause the most grief in an incident are the ones nobody has looked at properly in years. Think legacy case management platforms and file shares that became the archive by default. When we test public sector and legal estates, the crown jewels are rarely in the shiny new application. They sit in the old database that feeds it and the reporting extracts that pile up around it.
The LAA deserves some credit for publishing such a granular breakdown, and for being open that its earlier understanding was incomplete. But the minister herself has previously blamed fragile IT left behind by years of neglect. The £200m now earmarked shows what that neglect eventually costs, and that figure covers only recovery and modernisation, not the harm to the people whose information is out there.
I would also be cautious about reading too much into the absence of a leak. Data that has not been published has not necessarily stayed unused. Groups that extort organisations often hold, trade or reuse stolen material long after the headlines fade. Injunctions bind people in UK jurisdiction, not overseas criminals. Anyone named in this notice should assume the data could surface later, in phishing or in fraud, and plan accordingly.
What to do now
- Map and minimise old data. Find records held past their retention period, including in legacy systems, backups and exports, and delete or archive them offline. If you cannot say where your pre-2010 data lives, start there.
- Make breach scoping possible in advance. Keep an up to date data inventory that links systems to data categories and date ranges, so that an investigation can answer the question of what was taken in days, not months.
- Isolate or retire legacy platforms. Where an old system has to stay, put it behind strong network segmentation and limit who and what can reach it. This maps to the Cyber Essentials firewall and secure configuration controls.
- Harden access. Enforce multi-factor authentication on every portal and administrative route, review dormant and supplier accounts, and apply least privilege. These are core user access control requirements in Cyber Essentials.
- Patch and monitor. Keep supported software up to date under the security update management control, and invest in logging that can reconstruct data access after the event, not only flag it in real time.
- Warn your people. Law firms, chambers and legal aid providers should brief staff and clients to verify any unexpected request that quotes a case reference or payment detail, using a known contact route.
Bottom line
The LAA breach is now bigger in time, if not necessarily in headcount, than first understood. It reaches back to 1978 and into probation records. For every UK organisation, it shows that data kept for decades in hard-to-analyse legacy systems becomes a liability the moment an attacker gets in. Cutting what you hold and knowing where it lives are as much a part of defence as any firewall.
Sources
- GOV.UK: Legal Aid Agency cyber security incident data update October 2026
- Civil Service World: Legal Aid Agency data breach: Compromised records date back to 1978
- SecurityWeek: UK Legal Aid Agency Hack Scope Widens After Forensic Review
- DataBreaches.net: Legal Aid Agency cyberattack: Compromised data goes back to 1978
