The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
In May last year, the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not share the full scope of the incident.
An incident update published this week reveals that most of the compromised records are related to applications, claims, and payments submitted between 2007 and 2025.
However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.
“The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978,” the update reads.
Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.
The hackers also exfiltrated data pertaining to legal aid practitioners who interacted with LAA, including contracts, schedules, office locations, payment details, and user account credentials.