AN update on the UK Legal Aid Agency (LAA) cyberattack reveals that data compromised in the 2025 breach extends much farther back than previously understood. The agency has completed analysis to identify the date range and types of information affected, reporting that the vast majority of data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during that period. However, it also confirmed that approximately 250,000 records predate 2007, meaning some older information was exfiltrated.
The investigation notes that responsibility for the attack had been claimed by the ShinyHunters group, and the government sought an injunction to prevent publication of stolen data. The article stresses that such injunctions generally do not stop criminals from leaking data and can constrain journalists and others in certain jurisdictions; in this case, the government stated that ShinyHunters’ claims could not be verified, and the data were never leaked.
The update highlights the difficulty of assessing full impact given the spread of data over many years, but the agency’s current position is that the majority of affected records cover the 2007–2025 window, with a non-trivial minority predating 2007.