Britain’s Legal Aid Agency has revealed that a 2025 cyberattack exposed a much wider range of personal information than previously understood, including around 2.5 lakh records created before 2007 and some data dating back to 1978.
The latest forensic analysis also found that information linked to people supervised by the HM Prison and Probation Service was among the material stolen by the attackers.
The Ministry of Justice said it still has no indication that the stolen information has been published or shared.
The420.in had earlier reported the original Legal Aid Agency breach after authorities confirmed that hackers had accessed sensitive personal and financial information. The new update significantly expands the known historical reach of that stolen dataset.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Around 2.5 Lakh Records Predate 2007
The cyberattack was first detected on April 23, 2025, when authorities identified suspicious activity affecting the Legal Aid Agency’s online systems.
By May 16, investigators had established that the attackers had accessed and removed a significant quantity of personal information belonging to legal aid applicants and providers.
Initial public warnings focused largely on records dating from 2010 onwards.
Further digital analysis has now changed that picture.
The Ministry of Justice says most affected Legal Aid Agency data still relates to applications, claims or payments submitted between January 2007 and May 16, 2025.
However, investigators have confirmed that approximately 2.5 lakh records are older than 2007.
Most of those records date from the 1990s and early 2000s.
A much smaller number go back even further, with the earliest verified record currently dating from 1978.
Authorities have stressed that this does not mean everyone who interacted with the legal aid system during those decades had their information stolen.
The amount and type of information compromised varies between individuals.
Stolen Data May Include Financial and Identity Details
The compromised information could include names, dates of birth, addresses, National Insurance numbers and information about legal aid applications or cases.
Some records may also contain financial information.
Data relating to legal aid providers could include bank account names, account numbers, sort codes, payment information and portal login details.
The latest analysis also identified information belonging to a relatively small number of people who were being supervised by probation services.
That data may include names, dates of birth, nationalities and case reference numbers.
More than 99% of the affected probation records relate to people supervised during 2016 and 2017.
Officials said none of this probation information relates to victims of crime.
Importantly, the government says no individual appears to have had an entire legal case file stolen.
The compromised material was often fragmented, incomplete or spread across different systems.
Why It Took More Than a Year to Identify the Full Scope
Cyber investigations involving old government systems can take months or even years because stolen information is not always stored in a clean, searchable database.
The Legal Aid Agency breach involved large volumes of unstructured and fragmented material.
Investigators therefore had to reconstruct what the attackers accessed, identify individual records and determine their age and contents.
The process has gradually produced a clearer picture of the incident.
The Ministry of Justice says its earlier statements reflected the information available at the time rather than the final scope of the breach.
The incident also disrupted Legal Aid Agency systems for months.
Temporary processes had to be introduced so lawyers could continue submitting applications and receiving payments while digital services were restored.
The agency has since strengthened authentication and access controls, increased security monitoring and begun retiring or isolating older technology considered higher risk.
It is also continuing longer-term work to modernise legacy systems.
Old Data Can Still Create Modern Fraud Risks
A record from the 1990s or early 2000s may appear too old to be useful to criminals.
That is not necessarily true.
Dates of birth, National Insurance numbers, previous addresses and family or legal information can remain valuable for identity theft and social-engineering scams decades later.
Criminals can combine old information with newer data obtained from other breaches to create convincing impersonation attempts.
For example, knowing that someone previously received legal aid or dealt with a particular court could make a fake government call or email appear more credible.
The government has advised potentially affected people to remain cautious about unexpected requests for personal or financial information and to verify the identity of anyone contacting them.
Authorities have also recommended strong, unique passwords rather than reusing the same credentials across different services.
What this means for you:
If you have previously used legal aid services in England or Wales, treat unexpected calls or emails referring to old cases with caution. Never provide financial or identity information until you independently verify who is contacting you.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
