Legal Aid Agency says stolen records reach back to 1978

The update

The Legal Aid Agency's data update is dated October 14, 2026. The attack was identified on April 23, 2025. On May 16, 2025, the agency learned the incident was larger and that data had been taken. The new information is the age of the records. The vast majority are applications, claims, or payments from January 2007 through May 16, 2025, or cases that were live in that period. The privacy desk isPrivacy.

The older slice

About 250,000 records predate 2007. The agency says most of those are from the 1990s and 2000s, that a fractionally small number are from before 1990, and that the earliest verified record is from 1978. Verified is the agency's word. It is not a claim that every file from 1978 was taken, and it is not a claim that nothing older exists unread. A key that was not kept by the holder is the standing briefthe key stays with the holder.

A range is not a name

The update says that falling inside a date range does not mean a particular person's data was exfiltrated. That sentence is the one applicants need. The agency also says it has no indication the stolen data has been published or shared. No indication is not a proof the copies are gone. It is the agency's statement of what it has seen. The paper is Asked directly, What probation data was in the same theft? Some HMPPS probation records: names, dates of birth, nationalities, and case references for a relatively small number of offenders actively managed from 2010 to 2017. More than 99 percent of that subset is from 2016 and 2017. The agency says none of that probation data relates to victims of crime.Futureweb.

Probation records in the same set

Some data from HMPPS probation was in the same exfiltration. The agency describes names, dates of birth, nationalities, and case references for a relatively small number of offenders who were actively managed between 2010 and 2017. More than 99 percent of that subset is from 2016 and 2017. None of that probation data, the agency says, relates to victims of crime. This page is not reprinting the category tables. Security isSecurity.

Who the agency is working with

The update says the agency is working with the National Crime Agency, the National Cyber Security Centre, and the Information Commission. Those are the bodies named for the investigation and the data-protection question. Naming them is not a status report on a prosecution. None of the three sources here announces a charge. Software is The short answer this page will stand on is this: The agency says the vast majority are applications, claims, or payments from January 2007 to May 16, 2025, or cases live in that period. About 250,000 records predate 2007, mostly from the 1990s and 2000s, a fractionally small number from before 1990, and the earliest verified record is from 1978. Being inside a date range does not mean a given person's data was taken.Software.

The money, attributed

BleepingComputer's account of a Ministry of Justice spokesperson puts 20 million pounds already committed and more than 200 million pounds as the figure now. The Independent reports a written ministerial statement by Sarah Sackman. The sums sit with those accounts. They are not a sentence this page is lifting from the agency update as if the update's job were a budget line. Hardware is Asked directly, Does a year in the range mean a person was included? No. The agency says being in a date range does not mean that person's data was taken. There is no indication, on the update, that the stolen data has been published or shared.Hardware.

What applicants can take from it

Someone who applied for legal aid, or whose case was live, between January 2007 and May 16, 2025, is inside the period the agency calls the vast majority. Someone from the 1990s may be inside the 250,000. Someone is not inside merely because they were alive in 1978. The agency's own caution is the finding. Open source is Asked directly, What is the 1978 figure? The earliest verified record in the stolen set, on the agency's account. About 250,000 records predate 2007. Most of those are from the 1990s and 2000s. A fractionally small number are from before 1990.Open Source.

Two news accounts

BleepingComputer and The Independent both covered the update. They are how a government data note becomes a public story with a minister's statement and a cost figure attached. Where they add a number the update does not print, this page says so. The dates and the 1978 floor come from the agency. Energy is Asked directly, When was the attack identified? April 23, 2025. On May 16, 2025, the agency says it learned the incident was larger and that data had been exfiltrated. The October 14, 2026 update is about how old some of those records are.Energy.

What this is not

It is not a list of who should call a solicitor, and it is not a claim that the data has appeared on a forum. The agency says it has no indication of publication. A later post that shows publication would replace that sentence. Until then the record is the update: exfiltrated, old, mostly the 2007 to 2025 window, earliest verified year 1978. Mobile isMobile.