Legal Aid Agency hackers made off with records dating back to 1978

Hackers who broke into the UK's Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought.

The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978.

That's much further back than the agency previously estimated ­­– it initially said the stolen data covered legal aid applications, claims, and payments from 2007.

Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990.

Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking.

That wasn't the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017.

The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017.

It stressed that none of the stolen probation information relates to victims of crime.

The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information.

The agency first detected the intrusion on April 23, 2025, but officials didn't establish the scale of the compromise until May 16.

The government subsequently took the LAA's online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases.

The disruption dragged on for months, with the agency's troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems.

Further forensic work has now revealed that the data theft goes back much further than officials originally believed.

The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings.