Check Probation and Legal Aid Records After 250,000 Files Stolen in 1978-Dating LAA Breach
Hackers stole nearly 50 years of legal aid and probation records from the UK Legal Aid Agency, affecting hundreds of thousands of individuals.
Key points
- The Legal Aid Agency confirmed attackers stole records dating back to 1978 during an April 2025 breach.
- Approximately 250,000 records predate 2007, with most originating in the 1990s and 2000s.
- Stolen data includes probation service records for offenders supervised between 2010 and 2017.
The UK Legal Aid Agency (LAA) confirmed that hackers who breached its systems in April 2025 exfiltrated sensitive records dating back to 1978. This disclosure significantly expands the scope of the incident, which was initially reported in early May 2025. The agency, an executive body of the Ministry of Justice, manages public defense services across England and Wales. The breach affects applicants, recipients, and legal aid providers who interacted with the agency over nearly five decades.
Root cause
The LAA detected the intrusion on April 23, 2025, but did not fully understand the scale of the compromise until mid-May. Initial assessments suggested the stolen data covered applications and payments from 2007 onward. However, subsequent analysis revealed that approximately 250,000 records predated 2007. The Ministry of Justice stated that prior to the attack, it had committed £20 million to upgrading the agency’s digital systems, though the breach still occurred.
Attack path
Attackers accessed the LAA’s IT systems and downloaded a large volume of sensitive information. The stolen data includes contact details, dates of birth, national ID numbers, criminal history, and employment status for applicants and recipients. Providers’ data was also compromised, including contracts, financial information, and LAA Online Portal credentials. Additionally, the Ministry of Justice discovered that hackers accessed HM Prison and Probation Service records, including names and case reference numbers for offenders supervised between 2010 and 2017.
Affected versions
- Records from January 2007 to May 2025 constitute the vast majority of the breach.
- Approximately 250,000 records date from before 2007, mostly from the 1990s and 2000s.
- A small fraction of records originate before 1990, with the earliest verified record from 1978.
- Probation records concern offenders supervised between 2010 and 2017, with over 99 percent from 2016-2017.
Mitigation
- The LAA took its online services offline after detecting the intrusion, disrupting legal aid providers.
- The Ministry of Justice published updates on GOV.UK as its understanding of the attack developed.
- No specific software patch or technical fix for the underlying vulnerability has been confirmed in the source material.
- The agency continues to analyze the exfiltrated data to determine the full extent of the compromise.
For customers and users
Individuals who applied for or received legal aid, or those supervised by probation services, should monitor their personal information closely. Review bank statements and credit reports for unusual activity, as financial data and national ID numbers were exposed. Be wary of unsolicited communications claiming to be from the Legal Aid Agency or government bodies, as attackers often use breached data to craft convincing phishing messages. Verify the identity of any caller or email sender through official channels before sharing personal details or making payments.
What to do and how to stay safe: Legal Aid Agency
- Check your credit reports for unauthorized inquiries or new accounts opened in your name.
- Enable multi-factor authentication on all email and financial accounts to prevent credential stuffing.
- Review your LAA Online Portal credentials and change passwords if you are a legal aid provider.
- Monitor your mail and email for suspicious documents that reference your legal aid or probation history.
Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is affected by the Legal Aid Agency breach?
Applicants, recipients, and providers of legal aid services in England and Wales, as well as offenders supervised by probation services between 2010 and 2017.
How far back do the stolen records go?
The stolen records date back to 1978, with approximately 250,000 records predating 2007.
Does the breach include victim data?
The Ministry of Justice stated that none of the stolen probation information relates to victims of crime.
