Legal Aid Breach Update: Older Records Were Stolen
New analysis of the 2025 attack identifies roughly 250,000 records from before 2007. That is a count of records, not people—and it does not mean every former legal aid applicant was affected.
The short version
What you need to know
- This is new information about the cyberattack discovered in April 2025, not an announcement of a new attack.
- The agency says approximately 250,000 stolen records predate 2007; the earliest verified record dates from 1978. Records are not a count of unique individuals.
- Being in a listed group does not establish that your data was stolen. Check the official notice and verify unexpected contact independently.
What the October update changes
The Legal Aid Agency's 14 October update expands its account of the data stolen during the cyberattack identified on 23 April 2025. Most affected LAA data concerns applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live during that period. Further analysis has identified approximately 250,000 records from before 2007.
Most of those older records are from the 1990s and 2000s. The earliest verified record dates from 1978, but that does not establish continuous coverage of everyone who used legal aid since then. The agency explicitly warns against assuming everyone in an affected date range had information stolen.
Why an old record can still matter
Depending on the group and the individual, the notice lists information such as names, dates of birth, National Insurance numbers, contact details, financial information or case details. Not every listed field applies to every person. The agency also identifies some probation-service information in the stolen material; it says none of that probation data relates to victims of crime.
As of the update, the agency says it has no indication the stolen data has been published or shared. That is not a guarantee against future misuse. Old personal details could help an impersonator sound convincing, so knowing something about a past case is not proof that a caller is genuine.
What to do without sharing more sensitive information
Start with the official GOV.UK update linked below. Its tables separate different groups, dates and possible data types. They are not a personal breach-confirmation service. If you need clarification, use the contact routes on that notice or your existing legal representative's verified contact details rather than a number in an unexpected message.
Pause before responding to an unsolicited request for money, identity documents or account details. Verify it through a separate, established channel. Do not post case information or identity numbers publicly to ask whether you were affected. Use strong, unique account passwords; changing a password cannot erase identity information already stolen.
Where a VPN does not help
A VPN protects the network path between your device and the VPN service. It cannot recover records stolen from an agency, prevent an impersonator calling you or establish that a payment request is genuine. For this incident, the useful safeguards are cautious verification and following the agency's current guidance—not buying a VPN subscription.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.