UK Legal Aid Agency breach exposes records dating back to 1978

The UK Ministry of Justice disclosed that a cyber-intrusion on the Legal Aid Agency in April 2025 resulted in the theft of about 250,000 records, with data stretching back to before 2007 and one item as old as 1978. Most of the newly identified files originate from the 1990s and 2000s, while a tiny fraction predates 1990. The breach also exposed details from the HM Prison and Probation Service, covering offenders supervised between 2010 and 2017, including names, dates of birth, nationalities and case references.

The compromised information may contain addresses, National Insurance numbers, financial details and criminal-justice histories such as charges and convictions. Authorities have found no evidence that the data has been published, but the fragmented nature of the systems delayed a full assessment. In response, the Ministry has upgraded authentication, improved monitoring, patched vulnerabilities and is retiring high-risk legacy systems. The incident raises concerns about the retention of decades-old personal data in government databases.