Legal Aid Agency cyber security incident data update October 2026

On Wednesday 23 April 2025, we identified a cyber-attack affecting the Legal Aid Agency’s (LAA) online digital services 

In the days following the discovery, we took immediate action to secure our systems and informed legal aid providers that some of their information, including financial information, may have been compromised. We have continued to work with the National Crime Agency, National Cyber Security Centre, and Information Commission (formally the Information Commissioner’s Office) as part of our response. 

On 16 May 2025, we established that the attack was more extensive than originally understood and that the criminal group behind it had accessed and exfiltrated a significant amount of personal data. We subsequently informed the public that this included information relating to legal aid applicants and providers. 

Since then, extensive and detailed digital analysis has continued. The objective has been to establish more precisely what data was exfiltrated. That work has refined our understanding of both the date range and the type of information affected.

What we now know about the data

The vast majority of the LAA data relates to applications, claims or payments submitted to the LAA between January 2007 and 16 May 2025, or to cases that were live during this period. However, we have now confirmed that approximately 250,000 records predate 2007. The overwhelming majority of these are from the 1990s and 2000s, with only a fractionally small number dating from before 1990. The earliest record currently verified dates from 1978. 

Our analysis has also established that some information relating to HM Prison and Probation Service (HMPPS), specifically probation data, was contained within material exfiltrated during the same cyber-attack. None of this data relates to victims of crime. 

The nature and amount of information affected varies considerably between individuals. Additionally, but importantly; we have no indication that the stolen data has been published or shared. 

It is important to put this updated information in context. The presence of records predating 2007 does not mean that everyone who received or applied for legal aid, or otherwise interacted with the justice system before 2007, has been affected. 

We recognise that people will want to understand whether this incident is relevant to them specifically. The information below therefore provides more detail about the groups potentially affected and the types of data that may have been exfiltrated. 

The below tables should not be read as meaning that every individual within a particular group had all, or any, of the information listed exfiltrated. The information exfiltrated, if any, varies between individuals. In all cases personal details and circumstances are as they were reported to LAA at the point of any application, or subsequent amendment to that application.

Legal aid applicants and recipients

Legal aid practitioners

Legal aid practitioners (Solicitors, Providers, Barristers and others who interact with the Legal Aid Agency’s systems and processes) have been notified and updated throughout the incident via GOV.UK and through Legal Aid Agency (LAA) staff. Data affected in relation to legal aid providers may include: 

• Provider contracts, schedules, offices and office locations, details of payments received and financial account information, banking details including bank account name, account number and sort code and contact information;  

• user account and access details for the LAA’s Online Portal, including names, and email addresses of users; 

• records relating to correspondence and notifications from the LAA’s CCMS and MAAT systems; 

• In certain circumstances, limited information entered into, or generated by, the LAA case management systems may also have been affected, such as the names of fee earners associated with a legal aid case.

Others connected with legal aid cases

HMPPS information  

Our improved cyber capabilities have also identified that data relating to probation service users was also accessed. The data exfiltrated by the attackers includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017 (although more than 99% of the data in question related to offenders under supervision between 2016 and 2017 specifically).

Why has this information changed? 

The cyber-attack affected a number of complex digital systems and significant volumes of information. Much of that data was unstructured, fragmented, or incomplete. This has made analysing the data complex. Therefore, since the incident, specialist technical and data teams have undertaken extensive work to understand what information the attackers accessed and exfiltrated. 

Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised. 

Our previous public updates reflected the best information available to us at the time. We are updating this notice because that further analysis has changed part of our understanding of the data affected. We want the information available to the public to reflect what we now know.

What should I do? 

The steps you should take will depend on the nature of the information that may have been compromised. 

We continue to recommend that people who believe they may have been affected: 

• remain alert to suspicious messages, emails or telephone calls;  

• be cautious about unexpected requests for personal or financial information;  

• independently verify the identity of anyone asking for sensitive information; and  

• ensure that passwords are strong and are not reused across different accounts.  

Further advice on protecting yourself following a data breach is available from the National Cyber Security Centre.

Does this mean my data was compromised? 

No. The fact that you received or applied for legal aid during one of the periods described above, or interacted with the Probation Service, does not, by itself, mean that your information was contained in the data exfiltrated by the attackers. Similarly, where several possible types of information are listed for a particular group, this does not mean that every type of information was compromised for every person.

Has the stolen information been published? 

We have no indication that the stolen data has been published or shared.

What are we doing in response? 

Since the attack, the Ministry of Justice and Legal Aid Agency have undertaken significant work to strengthen the security of the technology estate and reduce the risk of a similar incident occurring again. 

This includes strengthening authentication and access controls, improving security monitoring, addressing vulnerabilities, retiring or isolating higher-risk technology and progressing longer-term work to modernise legacy systems. 

We continue to work with the National Cyber Security Centre and other specialist partners. We made the Information Commission aware of the cyber-attack and will continue to engage with them.

Further information 

We recognise that this incident may cause concern. We will continue to keep the information on this page under review and update it where appropriate. 

For queries relating to the cyber-attack, contact the LAA Customer Services Team on 0300 200 20 20, between 9am and 5pm, Monday to Friday. 

Alternatively, contact the Chief Executive’s Correspondence and Parliamentary Engagement Team at corporatecorrespondenceteam@justice.gov.uk. 

Case-specific queries should continue to be directed through the usual LAA channels. These are the contact routes currently published on the main incident page.

Related links

Minister Sarah Sackman MP Written Ministerial Statement – Legal Aid Agency Cyber-Security Incident: Data Update 14 October 2026

Legal Aid Agency cyber security incident – GOV.UK

Data breach FAQs