The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
The agency employs around 1,250 staff, oversees billions in legal funding, and works with approximately 2,000 providers, including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales.
The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised.
Two weeks later, it confirmed the resulting data breach was more serious than first believed after finding that attackers had stolen a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, as well as contribution amounts, debts, and payments.
The threat actors have also stolen legal aid providers' data, including provider contracts, office locations, financial information, contact details, LAA Online Portal credentials (including names and email addresses), and more.
In an update published this week, the LAA said follow-up analysis of the exfiltrated data found that the stolen records go back almost five decades.
"The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007," the agency said. "The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978."