Legal Aid Agency publishes updated account of data taken in 2025 cyber attack

The Legal Aid Agency (LAA) has published an update on the personal data taken in the cyber attack on its online digital services. The agency first identified the attack on Wednesday 23 April 2025. A Written Ministerial Statement giving a data update is dated 14 October 2026.

The LAA says detailed digital analysis has continued since the attack. That work has refined its understanding of the dates covered and the types of information affected. It has now confirmed that approximately 250,000 records predate 2007. It also says some probation data held by HM Prison and Probation Service (HMPPS) was in the material taken.

The agency states that it has "no indication that the stolen data has been published or shared".

What the new analysis found

The LAA says most of its affected data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or to cases that were live in that period. Of the older records, the overwhelming majority are from the 1990s and 2000s. The earliest record verified so far dates from 1978.

The probation data includes some names, dates of birth, nationalities and case reference numbers for a relatively small number of offenders actively managed by Probation Services between 2010 and 2017. The agency says more than 99% of that data related to offenders under supervision between 2016 and 2017. None of it relates to victims of crime.

The LAA stresses that the presence of older records does not mean that everyone who applied for or received legal aid before 2007 has been affected. It explains that much of the data was unstructured, fragmented or incomplete, which made the analysis complex, and that its earlier public updates reflected the best information available at the time.

Data relating to providers and practitioners

The LAA says legal aid practitioners have been notified and updated throughout the incident through GOV.UK and its staff. Data affected for providers may include:

• provider contracts, schedules, offices and office locations
• details of payments received, financial account information and banking details, including account name, account number and sort code
• user account and access details for the LAA Online Portal, including names and email addresses of users
• records of correspondence and notifications from the CCMS and MAAT systems
• in certain circumstances, the names of fee earners associated with a legal aid case

For Crown Court trials attended between August 2010 and August 2017, or July 2018 and January 2025, affected data may include the full names of solicitors and advocates and their organisation or chambers, for both defence and prosecution.

Client groups listed in the update

The update sets out tables of client groups and the types of data that could be affected. For civil certificated cases managed on the Client and Cost Management System (CCMS), where work was saved or submitted by the solicitor between March and May 2025, this may include all answers entered, including financial assessments and merits or legal assessments. For Very High Cost Cases, payments made between 1981 and 2004 are listed, including the name of the instructed solicitor or advocate receiving payment.

The LAA says the tables do not mean that every person in a group had all, or any, of the listed information taken.

Response and contact routes

The agency describes work to strengthen authentication and access controls, improve security monitoring and modernise older systems. It continues to work with the National Cyber Security Centre, and it has made the Information Commission aware of the attack.

It continues to recommend that people who believe they may have been affected remain alert to suspicious messages, emails or calls and independently verify anyone asking for sensitive information. Queries about the attack can go to the LAA Customer Services Team on 0300 200 20 20, between 9am and 5pm, Monday to Friday. Queries about specific cases continue to go through the usual LAA channels.

Where to read more

The full update, including the complete tables of affected groups, is published by the Legal Aid Agency on its own page on GOV.UK.