Legal Aid Agency Attack Stole Decades of Justice System Records

What the Forensic Analysis Found

The Legal Aid Agency confirmed the stolen data spans from 1978 to May 2025. The vast majority of records come from 2007 onwards, but around 250,000 predate that year. Most of the older material is from the 1990s and 2000s, with a small fraction from before 1990.

The breach also captured probation service data, including names, dates of birth, nationalities and case reference numbers. This category was not mentioned in the initial May disclosure. Officials described the stolen data as unstructured, fragmented and incomplete, which made the full scope difficult to assess quickly.

Stolen Records and Their Contents

The exfiltrated material varies by case but can include full names, dates of birth, National Insurance numbers, postal codes, equality monitoring codes, case start and end dates, costs claimed and VAT amounts. Some records contain financial assessments of defendants and their partners, including details of bank accounts and property.

In certain cases, partially redacted payment card details were taken. The stolen data also includes the names of judges, defense and prosecution lawyers and court reporters involved in Crown Court trials, along with details of opposing parties in civil cases.

How the Attack Happened

Justice Minister Sarah Sackman stated that criminals exploited vulnerabilities in the Legal Aid Agency IT systems. Once inside, they gained access to systems holding personal information, copied the data and exfiltrated it from the network.

The attackers claimed to hold data on more than two million people and demanded payment. The UK government has a longstanding policy of refusing extortion demands. In May, a ministry spokesperson said publication of the data was a question of when, not if.

Current Status of the Stolen Data

Sackman told the House of Commons that the department has no indication the stolen data has been published or shared. This represents a shift from the earlier position that release was expected.

The Legal Aid Agency emphasized that the presence of older records does not mean everyone who applied for legal aid or interacted with the justice system before 2007 has been affected. The agency said earlier public statements reflected the best information available at the time.

Why This Breach Matters

The stolen records include sensitive categories. Charities warned in May that the data could contain information about women and girls who survived domestic abuse. Legal aid applications often involve criminal histories, financial hardship and family disputes.

The inclusion of probation data and details of judges, lawyers and opposing parties extends the impact beyond legal aid applicants. People who interacted with the justice system decades ago may now face exposure of old case details, financial circumstances and personal identifiers.

Steps for Affected Individuals

Anyone who applied for legal aid or was involved in cases handled by the Legal Aid Agency should watch for signs of identity fraud, such as unexpected credit activity or contact from services they did not apply for. Consider placing a fraud alert with credit reference agencies and report suspicious activity to Action Fraud, the UK fraud reporting center.

1. Monitor credit reports and bank statements for unexpected activity
2. Place a fraud alert with credit reference agencies if concerned
3. Report suspicious activity to Action Fraud
4. Be alert for phishing attempts that reference your case details
5. Contact the Legal Aid Agency if you have specific questions about your records

Questions readers ask

Source and reporting limits

Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.