UK Legal Aid Agency: Hackers stole records dating back to 1978
UK Legal Aid Agency confirms hackers stole records dating back to 1978 in April 2025 breach.
Run Ministry of Justice?
Get an email when a reviewed story names Ministry of Justice, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The UK's Legal Aid Agency (LAA) has confirmed that a data breach in April 2025 resulted in the theft of sensitive records, some dating back to 1978. The attackers exfiltrated applicant and provider data, including personal identification details, criminal history, financial information, and LAA Online Portal credentials. The agency is investing over £200 million in modernizing its digital systems and strengthening cybersecurity.
The lesson from this incident
Full lessonThe Legal Aid Agency suffered a significant data breach in April 2025 that exposed highly sensitive personal, financial, and criminal records spanning nearly 50 years, indicating systemic failures in data lifecycle management and cybersecurity posture. The theft of LAA Online Portal credentials alongside personal data suggests inadequate access controls and insufficient protection of authentication systems. Retaining unencrypted or poorly secured records dating back to 1978 raises serious questions about data minimisation practices and whether legacy systems were adequately protected. This breach matters because the combination of criminal history, financial data, and identity information creates severe risks of fraud, extortion, and harm to vulnerable individuals who relied on legal aid services. The £200 million modernisation investment, while necessary, highlights how long-deferred digital transformation in public sector organisations can leave citizens exposed.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.