Summary
- Environment: Legal-aid digital services and stored justice records
- Operational impact: Online services taken offline in May 2025 during response
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
The Legal Aid Agency’s annual report says its systems were breached from December 2024 and data was exfiltrated from January 2025. The agency detected the attack on April 23, 2025. [2]
Impact
An October 14, 2026 update confirms approximately 250,000 affected records predate 2007, with the earliest verified record dating from 1978. These are older records within the incident, not a total count of affected people. [1]
The update also confirms that probation information belonging to HM Prison and Probation Service was among material stolen in the same attack. The agency says that probation data did not concern victims of crime. [1]
Potentially affected legal-aid information includes identity, contact, financial and case details, varying by individual and record. The agency said it had no indication the stolen data had been published or shared as of the update. [1]
Timeline
Attack detected
The agency became aware of the cyberattack on its digital services. See the source notice.
[3]Wider scope recognized; systems taken offline
The agency recognized extensive applicant-data access and took systems offline. See the source notice.
[3]Public notice issued
The agency published its data-breach notice. See the source notice.
[3]Older records and probation data confirmed
The update expanded the known affected data to pre-2007 records and probation information. See the source notice.
[1]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The reviewed official sources do not establish an initial access method or name the attacker. The intrusion began before the 2025 discovery and the later scope updates.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The agency took its online systems offline on May 16, 2025 after learning the attack was more extensive than first understood. It worked with the National Crime Agency and National Cyber Security Centre and informed the Information Commissioner. [3]
The October 2026 update describes stronger authentication and access controls, enhanced monitoring, vulnerability remediation and work to isolate or retire higher-risk legacy technology. [1]