The UK’s Legal Aid Agency (LAA) has released further details of a major cybersecurity breach, confirming that hackers obtained personal and financial information from legal aid systems, including historical records dating back nearly five decades.
The October 2026 disclosure identifies additional categories of compromised information affecting legal aid applicants, recipients, solicitors, barristers and other individuals involved in court proceedings.
- The Legal Aid Agency confirmed that approximately 250,000 compromised records predate 2007, with the earliest verified information dating from 1978.
- Stolen data includes legal aid applications, criminal case details, financial assessments, National Insurance numbers and legal service providers’ banking information.
- The breach also affected probation records covering a limited number of offenders. The government says there is no indication that the stolen information has been published or shared.
The investigation also established that information relating to HM Prison and Probation Service (HMPPS) was among the material stolen.
Approximately 250,000 records affected by the attack predate 2007. Most originated in the 1990s and 2000s, although a small proportion dates from before 1990. The earliest verified record dates to 1978.
The agency emphasized that the presence of historical records does not mean everyone who received legal aid or interacted with the justice system during those periods was affected.
Most compromised information relates to applications, claims and payments submitted between January 2007 and May 16, 2025, or to cases active during that period.
The extent of exposure varies considerably between individuals because much of the stolen information was fragmented, incomplete or unstructured.
The government said there is currently no indication that the attackers have published or shared the data.
Legal aid applicants’ personal and financial information exposed
The stolen material includes records from civil and criminal legal aid proceedings, with the categories of information differing according to the services provided and the systems used.
For recipients of Civil Legal Help or mediation, affected records cover solicitors’ cost claims submitted between January 2000 and May 2025.
Information may include full names, dates of birth, National Insurance numbers, postcodes, equality monitoring codes and case dates. Records may also contain legal aid classification codes, claimed costs and VAT amounts.
Individuals who received advice or assistance at police stations, representation in magistrates’ courts, advice concerning criminal appeals or assistance involving prison law may also be affected.
The relevant claims date from January 2007 to May 2025 and may contain surnames, initials, postcodes, case dates, costs and the locations of courts, prisons or police stations.
For individuals holding civil legal aid funding certificates or represented in the Crown Court, payment records from December 2019 to May 2025 may include full names, case references and amounts paid to legal representatives.
Separate records concern people who owed money to the LAA or its predecessor, the Legal Services Commission, following civil proceedings.
The agency’s updated notice identifies debt management activity dated between April 2019 and December 2025. Potentially compromised information includes names, case reference numbers, outstanding amounts, payment histories and correspondence concerning debts.
Payment records associated with civil legal aid contributions, statutory charges and debt recovery may contain transaction references, payment dates, amounts and methods. Some records involving card transactions include partially redacted payment card details.
Court records and legal aid assessments affected
The breach also involved the LAA’s Client and Cost Management System (CCMS), which processes civil legal aid applications, amendments, bills and payments.
For cases worked on between March and May 2025, hackers may have obtained information entered into applications and financial or legal assessments.
Depending on the case, this could include applicants’ names, addresses, dates of birth, National Insurance numbers, financial circumstances and details of legal proceedings.
Information relating to partners and other family members may also have been exposed where it formed part of an application or assessment.
Billing records could contain details of legal work performed and payments claimed by solicitors and other representatives.
The incident also affected certain correspondence generated through CCMS. This includes electronic communications sent to legal representatives between May 2022 and May 2025, as well as letters sent by post between November 2022 and March 2023.
Such correspondence may contain case references, funding decisions and confirmation of payments to legal representatives.
Some account records created between April 2014 and February 2023 may also include names, contact details, dates of birth and National Insurance numbers.
In criminal proceedings, the scope of potentially exposed data extends to financial contributions, defendants’ personal circumstances and court outcomes.
For certain Crown Court legal aid applications granted from March 2010, with contribution decisions made before July 2018, records may include information about applicants and their partners, employment status, property interests, bank accounts and other capital.
They may also identify offence categories, imprisonment status, contribution amounts, case costs and whether defendants were acquitted or convicted.
A limited number of additional contribution decisions from September 2018, December 2019 and February 2020 were also included.
Separate Crown Court trial records cover proceedings held between August 2010 and August 2017, and between July 2018 and January 2025.
The affected correspondence includes letters issued in May 2019 and between November 2022 and March 2023, along with records of emails that failed to reach solicitors between April 2021 and May 2025.
Historical records from the Very High Cost Cases funding scheme are also implicated. These cover payments made between 1981 and 2004 and may identify defendants, legal representatives, payment amounts and transaction dates.
Other potentially affected information concerns civil legal aid applicants who qualified for assistance through means-tested benefits between 1978 and 2012.
The records may identify benefit recipients and contain names, dates of birth, addresses and National Insurance numbers.
The agency also identified eight sets of correspondence issued in January 2008 concerning statutory charges on property arising from civil legal aid cases.
Legal service providers’ banking details compromised
The breach extended to information concerning legal aid practitioners and organizations contracted to provide legal services.
Potentially stolen data includes provider contracts, office locations, payment records and financial account information. Banking details may contain account names, account numbers and sort codes, alongside business contact information.
The attackers may also have accessed user records associated with the LAA’s online portal, including names and email addresses.
Correspondence from CCMS and the Means Assessment Administration Tool (MAAT) was also potentially affected, together with limited records identifying legal professionals who worked on individual cases.
The agency said solicitors, barristers and other legal aid providers have received information about the incident through official communications and government updates.
The investigation identified additional groups whose personal information may have been included in compromised court records. These include judges, prosecution and defence lawyers, advocates and court reporters involved in Crown Court proceedings during specified periods between August 2010 and January 2025.
Depending on their role, information may include names, professional organizations, chambers and other identifiers appearing in court records.
People involved as opposing parties in civil proceedings may also be affected where their information was entered into CCMS applications or amendments between March and May 2025.
A separate category covers individuals responsible for payment locations used to collect civil legal aid contributions or debts, whose records may include contact details, business names and reference numbers.
Probation service records also stolen
The LAA confirmed that information relating to a relatively small number of offenders supervised by probation services between 2010 and 2017 was included in the stolen material. These records may contain names, dates of birth, nationalities and case reference numbers.
More than 99% of the affected probation information relates to offenders under supervision during 2016 and 2017.
The government confirmed that none of the compromised probation data concerned victims of crime.
Cyberattack remained undetected for four months
The LAA’s systems were initially breached in December 2024, but the cyberattack was not identified until April 23, 2025. Following detection, the agency took steps to secure its systems and informed legal aid providers that some information, including financial records, might have been compromised.
On May 16, 2025, investigators established that the attackers had accessed and extracted substantially more personal information than originally understood.
The agency subsequently took its online portal offline and expanded its investigation into the compromised systems.
Since then, specialist technical and data teams have examined the stolen material to establish the categories of information affected and the relevant historical periods.
The LAA has worked with the National Crime Agency, National Cyber Security Centre and information protection authorities as part of its response.
The latest disclosure reflects the results of that forensic analysis rather than a newly reported cyberattack. The agency stressed that individual exposure cannot be determined solely by whether a person falls within an affected group or historical period.
Although the investigation has identified additional categories of compromised records, the government maintains that there is no evidence the stolen information has been published or shared.
