--- title: "Legal Aid Agency data incident" description: "The Legal Aid Agency expanded its breach assessment to older records dating to 1978 and probation information in October 2026." incident_type: "Data incident" status: "active" last_modified: "2026-10-16" canonical_url: "https://www.ally.security/incidents/legal-aid-agency-data-incident-2024" markdown_url: "https://www.ally.security/incidents/legal-aid-agency-data-incident-2024.md" stix_url: "https://www.ally.security/incidents/legal-aid-agency-data-incident-2024/stix.json" --- # Legal Aid Agency data incident The Legal Aid Agency’s annual report says its systems were breached from December 2024 and data was exfiltrated from January 2025. The agency detected the attack on April 23, 2025. Last modified Oct 16, 2026 · 3 sources ## Summary - **Environment:** Legal-aid digital services and stored justice records - **Operational impact:** Online services taken offline in May 2025 during response - **Financial impact:** No incident cost established in the reviewed evidence ## What happened The [Legal Aid Agency](https://www.gov.uk/government/organisations/legal-aid-agency)’s [annual report](https://www.gov.uk/government/publications/legal-aid-agency-annual-report-and-accounts-2024-to-2025/annual-report-and-accounts-2024-25-accountability-report-html) says its systems were breached from December 2024 and data was exfiltrated from January 2025. The agency detected the attack on April 23, 2025. [2](#source-2) ## Impact An [October 14, 2026 update](https://www.gov.uk/government/news/legal-aid-agency-cyber-security-incident-data-update-october-2026) confirms approximately 250,000 affected records predate 2007, with the earliest verified record dating from 1978. These are older records within the incident, not a total count of affected people. [1](#source-1) The update also confirms that probation information belonging to [HM Prison and Probation Service](https://www.gov.uk/government/organisations/hm-prison-and-probation-service) was among material stolen in the same attack. The agency says that probation data did not concern victims of crime. [1](#source-1) Potentially affected legal-aid information includes identity, contact, financial and case details, varying by individual and record. The agency said it had no indication the stolen data had been published or shared as of the update. [1](#source-1) ## Timeline ### April 23, 2025 — Attack detected The agency became aware of the cyberattack on its digital services. See the [source notice](https://www.gov.uk/government/news/legal-aid-agency-data-breach). [3](#source-3) ### May 16, 2025 — Wider scope recognized; systems taken offline The agency recognized extensive applicant-data access and took systems offline. See the [source notice](https://www.gov.uk/government/news/legal-aid-agency-data-breach). [3](#source-3) ### May 19, 2025 — Public notice issued The agency published its data-breach notice. See the [source notice](https://www.gov.uk/government/news/legal-aid-agency-data-breach). [3](#source-3) ### October 14, 2026 — Older records and probation data confirmed The update expanded the known affected data to pre-2007 records and probation information. See the [source notice](https://www.gov.uk/government/news/legal-aid-agency-cyber-security-incident-data-update-october-2026). [1](#source-1) ### October 16, 2026 — Briefing updated This briefing was last reviewed and updated on October 16, 2026. ## Threat Group & Attack Vector The reviewed official sources do not establish an initial access method or name the attacker. The intrusion began before the 2025 discovery and the later scope updates. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The agency took its online systems offline on May 16, 2025 after learning the attack was more extensive than first understood. It worked with the [National Crime Agency](https://www.nationalcrimeagency.gov.uk/) and [National Cyber Security Centre](https://www.ncsc.gov.uk/) and informed the [Information Commissioner](https://ico.org.uk/). [3](#source-3) The October 2026 update describes stronger authentication and access controls, enhanced monitoring, vulnerability remediation and work to isolate or retire higher-risk legacy technology. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Legal Aid Agency cyber security incident: data update October 2026 official · Legal Aid Agency and Ministry of Justice · Oct 14, 2026 ### Annual Report and Accounts 2024-25: Accountability Report official · Legal Aid Agency · Nov 5, 2025 ### Legal Aid Agency data breach — notice updated July 31, 2025 official · Legal Aid Agency and Ministry of Justice · May 19, 2025
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Wider scope recognized; systems taken offline 2. **Occurred At · 100% confidence · current** Attack detected: 2025-04-23 3. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Pre-2007 Legal Aid Agency records (approximate count) 4. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Public notice issued 5. **Resulted In · 100% confidence · current** Older records and probation data confirmed: The update expanded the known affected data to pre-2007 records and probation information. 6. **Resulted In · 100% confidence · current** Attack detected: The agency became aware of the cyberattack on its digital services. 7. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: The agency took its online systems offline on May 16, 2025 after learning the attack was more extensive than first understood. It worked with the National Crime Agency and National Cyber Security Centre and informed the Information Commissioner. 8. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: The October 2026 update describes stronger authentication and access controls, enhanced monitoring, vulnerability remediation and work to isolate or retire higher-risk legacy technology. 9. **Affected Organization · 100% confidence · current** Legal Aid Agency data incident: Legal Aid Agency 10. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Potentially affected legal-aid information includes identity, contact, financial and case details, varying by individual and record. The agency said it had no indication the stolen data had been published or shared as of the update. 11. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: An October 14, 2026 update confirms approximately 250,000 affected records predate 2007, with the earliest verified record dating from 1978. These are older records within the incident, not a total count of affected people. 12. **Discovered At · 100% confidence · current** Legal Aid Agency data incident: 2025-04-23 13. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Attack detected 14. **Occurred At · 100% confidence · current** Public notice issued: 2025-05-19 15. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: The update also confirms that probation information belonging to HM Prison and Probation Service was among material stolen in the same attack. The agency says that probation data did not concern victims of crime. 16. **Occurred At · 100% confidence · current** Wider scope recognized; systems taken offline: 2025-05-16 17. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: The Legal Aid Agency’s annual report says its systems were breached from December 2024 and data was exfiltrated from January 2025. The agency detected the attack on April 23, 2025. 18. **Occurred At · 100% confidence · current** Older records and probation data confirmed: 2026-10-14 19. **Resulted In · 100% confidence · current** Public notice issued: The agency published its data-breach notice. 20. **Exposed Record Count · 100% confidence · current** Pre-2007 Legal Aid Agency records (approximate count): 250,000 record 21. **Resulted In · 100% confidence · current** Wider scope recognized; systems taken offline: The agency recognized extensive applicant-data access and took systems offline. 22. **Disclosed At · 100% confidence · current** Legal Aid Agency data incident: 2025-05-19 23. **Resulted In · 100% confidence · current** Legal Aid Agency data incident: Older records and probation data confirmed