UK Legal Aid Agency: Hackers stole records dating back to 1978

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.

The agency employs around 1,250 staff, oversees billions in legal funding, and works with approximately 2,000 providers, including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales.

The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised.

Two weeks later, it confirmed the resulting data breach was more serious than first believed after finding that attackers had stolen a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, as well as contribution amounts, debts, and payments.

The threat actors have also stolen legal aid providers' data, including provider contracts, office locations, financial information, contact details, LAA Online Portal credentials (including names and email addresses), and more.

In an update published this week, the LAA said follow-up analysis of the exfiltrated data found that the stolen records go back almost five decades.

"The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007," the agency said. "The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978."

However, it noted that records predating 2007 do not mean everyone who received, applied for legal aid, or interacted with the justice system before 2007 was affected.

"We recognise that incidents of this nature are concerning for anyone affected. That is why we published information on GOV. UK as quickly as possible and have continued to update it as our understanding of the cyber-attack has developed," a Ministry of Justice spokesperson told BleepingComputer.

"Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency's digital systems. We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services. There is currently no evidence that any personal data believed to have been exfiltrated has been published."

After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​claimed by the DragonForce ransomware operation, the country's National Cyber Security Centre (NCSC) published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.

In January, the UK also announced a new cybersecurity strategy, backed by more than £210 million ($283 million), to boost cyber defenses across government departments and the wider public sector.

This week, the UK Housing Ombudsman Service, a non-departmental public body sponsored by the Ministry of Housing that settles disputes between social housing residents and social landlords in England, disclosed that it is investigating a third-party IT security incident that impacted its case management system.