UK Legal Aid Agency expands account of data stolen in 2025 cyberattack
The UK Legal Aid Agency’s October 14 update says further analysis of its 2025 cyberattack identified approximately 250,000 affected records predating 2007, with the earliest verified record dating to 1978.
What the record says
Agency update published October 14, 2026.
Approximately 250,000 identified records predate 2007.
The earliest record verified in the agency’s analysis dates to 1978.
The agency says most affected LAA data concerns applications, claims, payments or cases from January 2007 to May 16, 2025. It has also identified some probation-service information in the stolen material. The types and amounts of information vary between individuals. At the time of the update, the agency said it had no indication that stolen data had been published or shared.
Source details and supporting locations.
Practical next step
Consult the agency’s category-by-category notice to understand potentially affected groups. It recommends caution with unexpected requests for personal or financial information and independently verifying anyone asking for sensitive details.
Limits and what is not established
This is a new account of a cyberattack identified in April 2025, not an announcement of a new October attack. Records are not a count of distinct people. The notice does not establish that everyone in a listed group was affected or that all listed fields were stolen for each person.
Sources checked October 14, 2026. Later notices may change instructions or arrangements.
Original sources
UK Legal Aid Agency: original information