The Ministry of Justice has disclosed that approximately 250,000 records dating from before 2007 were stolen during the 2025 cyberattack on the Legal Aid Agency (LAA), extending the previously understood historical reach of the breach.
In a written statement to Parliament on 14 October 2026, Courts and Legal Services Minister Sarah Sackman said the earliest record so far verified dates to 1978. The vast majority of the stolen LAA material still relates to the period from 2007 to May 2025, with most of the newly identified older records dating from the 1990s and 2000s.
What the latest investigation found
The government previously said attackers had obtained information connected with people who applied for or received legal aid between 2007 and 16 May 2025. Further technical analysis has now identified the additional historical records and confirmed that limited information relating to HM Prison and Probation Service was also stolen.
According to the department, the probation material includes some names, dates of birth, nationalities and case reference numbers relating to a relatively small number of people supervised between 2010 and 2017. The government says the probation material does not contain information about victims of crime.
Depending on the individual and record, compromised legal aid information may include names, addresses, dates of birth, National Insurance numbers, financial circumstances and details connected with legal proceedings. The Ministry of Justice says the amount and sensitivity of the material varies considerably, and no complete legal aid case record was compromised.
250,000 records does not mean 250,000 people
The newly confirmed figure counts records, not unique individuals. It does not establish that 250,000 additional people were affected. Nor does having received legal aid during a relevant period automatically mean that someone's information was stolen.
The government says much of the material was fragmented, incomplete or unstructured, complicating efforts to identify the people concerned.
Government allocates £200 million for recovery and modernisation
Sackman said £200 million has been allocated to recovery, transformation and replacing older systems with a modern technology platform. The department says it has strengthened authentication, access controls and security monitoring following the attack.
The original incident was identified in April 2025. The government subsequently established that criminals had copied a significant amount of personal data from LAA systems.
Officials say they currently have no indication that the stolen information has been published or shared. That is not the same as a guarantee that it will never be misused.
Advice for potentially affected people
The Legal Aid Agency advises anyone concerned about the breach to remain alert to unexpected messages, calls and requests for personal or financial information, to verify requests independently and to use strong, unique passwords.
The LAA customer services team can be contacted on 0300 200 20 20, Monday to Friday, 9am to 5pm.