The UK Ministry of Justice (MoJ) has again widened the known scope of the 2025 cyber attack on the Legal Aid Agency (LAA). Data stolen in the attack now includes records going back as far as 1978. In a written statement to the Commons on 14 October 2026, courts and legal services minister Sarah Sackman said most of the exfiltrated data dates from 2007 to 16 May 2025. She added that "a small proportion" of records predate 2007, and the earliest verified record is from 1978 (as reported by The Independent). This is the second time the government has pushed back the start of the affected period. It first said 2010 and changed that to 2007 in July 2025. No source available to us gives an official count of records or people affected. Reporting notes that figures attributed to the attackers have not been verified by the government (OpenClassActions).
What Happened
Pieced together from the available reporting, the timeline is:
- December 2024: Attackers were inside LAA systems from this point, according to MPs, as cited by OpenClassActions. That means roughly four months passed before anyone detected them.
- 23 April 2025: The MoJ became aware of an attack on the LAA's online service, which applicants and legal aid providers use to apply, log work and get paid. At first, the MoJ told providers that some of their details, including financial information, may have been compromised (OpenClassActions).
- 16 May 2025: The LAA found the attack was "more extensive than originally understood" and that applicant data, not just provider data, had been accessed. Systems were taken offline that day (OpenClassActions). 16 May is also the end date of the affected data window in later official statements.
- 19 May 2025: The breach was announced publicly, with a Commons statement the same afternoon. At this stage the stated window began in 2010 (OpenClassActions, Data Breach Radar).
- 31 July 2025: The MoJ revised the window to 2007 onward and added information about applicants' partners. The MoJ notice, reported via the Law Society Gazette, said "Previously we stated the data went back to 2010" (Data Breach Radar).
- 14 October 2026: Sackman's statement confirmed that some exfiltrated records predate 2007. Most of these date from the 1990s and 2000s, with "only a very small number" older than that (The Independent). A gov.uk "data update" published the same day is cited as the primary source by David's News.
Accounts differ on certainty. Data Breach Radar points out that the July 2025 MoJ wording said 2007-era data "may have been accessed", and stresses that this did not confirm every record in that period was taken. The October 2026 statement, as reported by The Independent, is firmer: criminals "copied and exfiltrated some data". It also describes the pre-2007 findings as "confirmed" after detailed analysis by specialist teams.
Operational impact. Online services have since been restored (OpenClassActions). The MoJ's own legal aid statistics bulletin, published 24 September 2026, says the attack "impacted data collection across all schemes". Some series, including criminal high cost claims, legal help starts and mediation starts, are still unavailable more than a year later. The LAA used contingency arrangements so that applicants could get help and providers kept being paid while systems were offline (GOV.UK statistics bulletin).
What Was Taken
According to the minister's statement as reported by The Independent, the data may include:
- Basic personal details: names, addresses and dates of birth
- Information about legal aid applications and cases
- In some instances, financial or other sensitive information
Other reporting adds:
- Criminal records: the MoJ had previously disclosed this (The Independent). OpenClassActions lists criminal history, financial details and addresses among the compromised fields.
- Partners of applicants: added to scope in July 2025 (Data Breach Radar, OpenClassActions)
- Legal representatives and providers: the incident covers civil and criminal applicants and their legal representatives (Wikipedia's list of UK government data losses). Provider details, including financial information, were the first data flagged at risk in April 2025 (OpenClassActions).
Volume: none of the sources we reviewed gives a government-confirmed record or victim count. The Wikipedia entry leaves the "records lost" field blank. OpenClassActions explicitly warns that figures attributed to the attackers have not been verified by the government. We are not publishing an unverified number.
Sensitivity: this is a very sensitive dataset. Legal aid is means-tested, so the files tie identity to financial hardship. Many records also relate to criminal proceedings, family disputes, domestic abuse or immigration matters. Now that records go back nearly five decades, some affected people may not remember ever applying and will not expect to be notified.
Why It Matters
- Scope creep is the pattern, not the exception. The affected period has moved from 2010 to 2007 to 1978 over about 17 months. Initial scope statements in large public-sector breaches should be treated as a minimum. Each revision brings in new victims who were told, in effect, that they were outside the blast radius.
- Legacy data is now a liability. Records from the 1970s through 1990s were reachable through a live online service that was compromised in 2024 and 2025. Data kept long past its operational need adds directly to breach impact.
- Long dwell time. If the MPs' December 2024 timeline is right (as cited by OpenClassActions), the attackers had about four months of undetected access, and the full extent was only understood about three weeks after first detection. That delay is a detection and logging failure on top of the initial exploitation.
- Downstream exposure in the legal sector. Provider and representative data was involved, and applicant files contain case details. Law firms and their clients face a higher risk of targeted phishing and fraud. Sector reporting already shows phishing and completion-payment fraud dominating legal-sector incidents, with 2,284 SRA-reportable UK legal breach incidents in the year to September 2024 (UK Cyber Defence threat report). Nothing in that report links those trends to the LAA incident. It is context only.
- The impact on government operations continues. Gaps in official legal aid statistics more than a year on show that the cost of an incident goes well beyond the data itself.
The Attack Technique
Official technical detail is limited. According to The Independent, Sackman's statement says the attack "happened because criminals were able to exploit vulnerabilities in the LAA's IT systems and gain access to systems containing personal information," before copying and exfiltrating data held by the MoJ.
The sources do not establish:
- The specific vulnerability, product or initial access vector
- Whether ransomware or encryption was involved, or whether this was purely data theft and extortion
- The identity of the threat actor. None of the sources here names or attributes a group.
The confirmed elements are exploitation of system vulnerabilities, a multi-month dwell time (per MPs, via OpenClassActions), and bulk exfiltration from systems connected to an internet-facing application and payment portal. Separately, the UK Cyber Defence legal-sector report flags two actively exploited SonicWall SMA1000 zero-days relevant to firms that use those appliances for remote access. That report does not connect them to the LAA breach, and neither do we.
What Organizations Should Do
- Enforce retention limits on live systems. Find records that are past their retention period and still reachable from production or internet-facing services. Archive them offline or delete them. Records from 1978 should not have been exfiltrated through a modern web portal.
- Patch and harden internet-facing legacy applications. Inventory public-facing case management, portal and payment systems, especially older platforms. Prioritise vulnerability remediation for them, and put them behind strong authentication and segmentation from bulk data stores.
- Monitor for bulk data access and exfiltration. Alert on unusual query volumes, large exports and outbound transfers from systems holding sensitive personal data. A four-month dwell time points to gaps in this kind of telemetry.
- Scope breaches conservatively and say so. When disclosing, state clearly that scope may grow. Build forensic workflows that check the full date range of what was reachable, not only what was expected to be there.
- Prepare legal-sector partners and clients for follow-on fraud. Firms whose staff or clients appear in LAA data should warn them about targeted phishing, impersonation of the LAA or MoJ, and payment-redirection fraud. Require out-of-band verification for any change to bank details.
- Test continuity plans for critical payment flows. The LAA's contingency payments kept providers funded. Organisations running similar portals should rehearse manual fallback procedures before they need them.
Sources: Legal aid cyber attack: Hackers stole records dating back to 1978... | Legal Aid Agency Data Breach: Why the Affected Application Period N... | List of UK government data losses | Legal Aid Agency Data Breach: What Was Taken, and When | UK updates public on Legal Aid Agency cyberattack — David’s News | Legal aid statistics England and Wales bulletin Apr to Jun ... | Legal Aid Agency cyber security incident data update ... | Legal services threat intelligence report — 29 August – 4 September…