Legal Aid Agency breach exposed records dating back to 1978
Hackers stole far more historical data from the UK Legal Aid Agency than the government first realised, including records dating back to 1978. The expanded scope of the April 2025 breach raises questions about why decades-old personal information remained accessible in government systems.
About 250,000 stolen records date from before 2007, though this is not a confirmed count of people affected; most are from the 1990s and 2000s. The haul may include sensitive financial and legal details, while separate records from the probation service cover a relatively small number of offenders supervised between 2010 and 2017; the government says none relate to crime victims.
- The breach included Legal Aid Agency records dating back to 1978.
- Around 250,000 stolen records pre-date 2007, not necessarily 250,000 people.
- Probation service records were also accessed, with no victim data involved.
New here? Start with this
The Legal Aid Agency is part of the Ministry of Justice and helps people who cannot afford legal advice or representation. Its records can include information about people who applied for help with legal costs and details of their cases.
The agency’s systems hold information gathered over many years, including personal, financial and legal details. The breach matters because old records can still be sensitive, and their presence raises questions about how government departments store and protect information over time.
The probation service, also within the justice system, supervises some people after they have been convicted of an offence. Its records are separate from legal aid files and concern people under supervision, rather than crime victims.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The expanded breach suggests that keeping decades of legal aid records accessible created avoidable privacy and security risks. People seeking legal help may have disclosed highly sensitive financial or legal details, so the government should explain why old data remained in its systems and whether retention and access controls were adequate.
The case against
Older records may have been retained for legitimate administrative, legal or public accountability needs, and their presence alone does not show that they were routinely accessible or that keeping them breached policy. The scale of the breach warrants scrutiny, but conclusions about preventability or official failure should wait for evidence about the systems, safeguards and retention rules involved.
Read the full article at the source →
Originally published by The Register as “Legal Aid Agency hackers made off with records dating back to 1978”.