Hackers stole UK legal aid records dating back to 1978 during a cyberattack last year, exposing personal and case information that had been stored for decades.
The Legal Aid Agency (LAA) has identified approximately 250,000 records predating 2007 among the material stolen in its 2025 breach, according to a new government update. The discovery provides a clearer picture of the information compromised during the attack.
Although many of the cases closed years ago, the personal details they contain could still be useful to criminals attempting identity theft or targeted fraud.
Stolen files contain benefit assessments and criminal case details
Records identified in the updated breakdown include benefit-status assessments and payments associated with high-cost criminal cases. Some entries contain names and National Insurance numbers, with case references or payment amounts. Most of the older records date from the 1990s and 2000s, with only a small proportion predating 1990.
Other affected files contain details about financial circumstances and court proceedings. Criminal case documents may identify charges or outcomes, while civil applications can include personal information about partners and family members who never applied for legal aid themselves.
Legal aid providers also had business information compromised, including contracts and banking details. Officials caution that the amount of information varies by individual, and no complete legal aid case record was stolen. Record totals also do not necessarily represent the number of affected people.
Probation records emerge as investigators examine the breach
Investigators also discovered files concerning a relatively small number of people managed by HM Prison and Probation Service. Stolen information includes names, dates of birth, nationalities, and case reference numbers. Officials confirmed that these particular records do not concern victims of crime.
According to the agency's annual report, attackers gained access to its systems months before the intrusion was discovered in April 2025. Subsequent investigations have been complicated by fragmented or incomplete files, making it difficult to determine exactly whose information was taken.
A ministerial statement to Parliament also confirmed that authorities have found no evidence that the stolen information had been published or shared.
Since the attack, the Ministry of Justice and LAA have strengthened access controls and improved security monitoring. Government officials have allocated £200 million for recovery and modernization, including work to replace aging systems. Further incident response measures include addressing weaknesses in older technology.
Old legal aid records could support targeted fraud
Information from long-closed cases could help criminals impersonate legal professionals or government representatives, particularly when combined with other identifying details.
Although officials have not confirmed related fraud, former clients and legal organizations should remain alert to suspicious requests involving historical case information.
- Former legal aid clients. An unexpected caller mentioning an old case number or solicitor's name should not automatically be trusted. Criminals could use such details in targeted phishing attempts to obtain additional information. Verify requests through official agency or legal provider contact details before responding.
- Solicitors and legal aid providers. Compromised payment information could support fraudulent requests to change bank details or release confidential documents. Confirm unusual instructions through established contact channels, and ensure staff recognize email spoofing attempts involving familiar names or addresses.
- Security teams managing legal records. Review access to historical case files and confirm which documents must still be retained. Monitor unusual downloads from archived systems and securely remove information once legal retention requirements permit. Include these repositories in routine data breach prevention reviews rather than limiting oversight to active systems.
For organizations maintaining extensive legal archives, the breach highlights the importance of securing historical records, particularly those stored in aging systems. Security teams should regularly review access permissions, monitor unusual activity, and securely remove information when legal retention requirements allow.
For individuals, the passage of time does not necessarily eliminate the risks associated with exposed personal information. Someone who received legal aid decades ago may still encounter suspicious communications referencing an old case or personal details.
The broader lesson is that sensitive information can remain valuable to criminals long after its original purpose has ended. Protecting it requires organizations to look beyond active systems and account for the data they continue to hold.
More cybersecurity news: At least 45 Al Jazeera devices were targeted in an AdFection campaign that turned advertising infrastructure into a spyware delivery channel.