Data stolen in the 2025 cyberattack on Britain's Legal Aid Agency stretches back to 1978 and includes some probation records, the agency said Wednesday in an update published on GOV.UK. The findings show how a breach of a system holding decades of legacy records can keep growing in scope long after the attack itself, a risk for any organization that keeps old data it no longer actively uses.

What Happened

The Legal Aid Agency, part of the Ministry of Justice, administers legal aid, the public funding of legal advice and representation. It identified an attack on its online services on April 23, 2025, and found on May 16, 2025, that the criminal group behind it had "accessed and exfiltrated a significant amount of personal data," meaning copied it out of the agency's systems.

The new update reflects further digital analysis. Most of the stolen data relates to applications, claims or payments from January 2007 to May 16, 2025. But about 250,000 records predate 2007, mostly from the 1990s and 2000s, and the earliest verified record dates from 1978. The agency said receiving legal aid does not by itself mean a person's information was taken, and it did not give a total number of people affected.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The stolen material also contained some data from the probation service: names, dates of birth, nationalities and case reference numbers for a "relatively small number of offenders" supervised between 2010 and 2017. More than 99% of that data relates to people supervised in 2016 and 2017.

What was taken varies by person and by period. For different groups of applicants it may include full names, dates of birth, addresses or postcodes, National Insurance numbers (the British equivalent of a Social Security number), case details, financial assessments and, in some Crown Court records, offences charged, pleas, convictions and sentences. Some payment records include partially redacted card details. For legal aid firms, the data includes contracts and bank account details. Names of some Crown Court judges, solicitors, advocates and court reporters, and of opponents in some civil cases, were also taken. The agency said none of the data relates to victims of crime.

Why It Matters

The update is a case study in the cost of keeping old records in reachable systems. Records going back nearly five decades were stolen along with current files. For boards and public-sector leaders, retention schedules and the isolation of legacy systems are breach-exposure decisions, not just records-management ones.

The type of data also raises the stakes. Combining identity numbers, financial assessments and criminal case outcomes creates sensitive profiles that could help fraudsters craft convincing, targeted scams. The agency urged people to be wary of unexpected requests for personal or financial information and to verify anyone who asks for it independently.

The breach also shows that a forensic picture can take more than a year to settle. Organizations that notify regulators and the public early should expect to issue updates as analysis continues.

Context

The agency said it has no indication the stolen data has been published or shared. It has worked with the National Crime Agency, the National Cyber Security Centre and the Information Commission, the U.K. data regulator formerly known as the Information Commissioner's Office. The government has not named the criminal group.

Since the attack, the agency says, it has strengthened authentication and access controls, improved security monitoring, fixed vulnerabilities, and retired or isolated higher-risk technology while modernizing legacy systems. Its incident page says access to online services, including its main case management system, has been restored. Minister Sarah Sackman also issued a written statement to Parliament on the update.

What to Watch

Watch for further refinements to the affected groups as analysis continues, any regulatory findings from the Information Commission, and any sign that the stolen data surfaces online, which would change the risk for the people named in it. Legal aid firms should also watch for fraud attempts that use the stolen contract and bank details.