THE UK’s Legal Aid Agency (LAA) has disclosed that a 2025 data breach exposed records dating back to 1978, with forensic review expanding the known scope. While initial disclosures in May 2025 described unauthorised access and data exfiltration affecting individuals who applied for legal aid, the latest incident update confirms that most compromised records relate to applications, claims and payments submitted between 2007 and 2025. An estimated 250,000 records predating 2007 were compromised, the majority from the 1990s and 2000s, with only a small fraction from before 1990.
Affected data include personal details of legal aid applicants and recipients—names, addresses, dates of birth, National Insurance numbers, postcodes, case references, responses entered into the CCMS system, phone numbers, and other information. Data tied to legal aid practitioners—contracts, schedules, office locations, payment details, and user credentials—were also exfiltrated. Additional exposure involved judges, solicitors, advocates, parties in civil proceedings, and those managing pay point locations.
The agency says probation service user data was accessed for a limited number of offenders managed between 2010 and 2017. Investigators stress the investigation was lengthy due to multiple systems and large volumes of unstructured, fragmented, and incomplete data, complicating analysis. LAA maintains there is no evidence that stolen information has been released publicly or sold, though the extended forensic scope underscores ongoing risk and the complexity of the breach.