The Legal Aid Agency (LAA) has provided an update on the cyber-attack identified on 23 April 2025, which affected its online digital services. Initial understanding of the breach on 16 May 2025 indicated a significant amount of personal data had been accessed and exfiltrated by a criminal group.
Further digital analysis has now confirmed that approximately 250,000 records predate 2007, with the overwhelming majority from the 1990s and 2000s. The earliest verified record dates from 1978. The vast majority of LAA data affected relates to applications, claims, or payments submitted between January 2007 and 16 May 2025, or cases live during this period.
The analysis also established that some probation data from HM Prison and Probation Service (HMPPS) was exfiltrated. This data includes names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders actively managed by Probation Services between 2010 and 2017, with over 99% relating to 2016-2017. None of this data relates to victims of crime.
The LAA states there is no indication that the stolen data has been published or shared. The nature and amount of information affected varies considerably between individuals.