INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers stole UK Legal Aid records dating back to 1978

| 2026-10-15 08:06 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
In April 2025, hackers breached the UK Legal Aid Agency's IT systems and stole records dating back to 1978. The attackers targeted the agency, which employs around 1,250 staff and oversees billions in legal funding, affecting approximately 2,000 providers including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales. The attack works by exploiting vulnerabilities in the agency's digital systems, allowing attackers to exfiltrate sensitive data such as contact details, dates of birth, national ID numbers, and financial information. As a result of the breach, the LAA has disclosed that follow-up analysis found records dating back almost five decades were stolen, with approximately 250,000 records predating January 2007, mostly from the 1990s and 2000s, including one record from as early as 1978.
Technical Mitigations AI-generated
• Patch DragonForce ransomware operation's vulnerabilities to prevent similar attacks. • Implement data encryption and secure storage for sensitive applicant and recipient data, including contact details, dates of birth, national ID numbers, criminal history, employment status, contribution amounts, debts, and payments. • Regularly monitor LAA Online Portal credentials (including names and email addresses) for suspicious activity to prevent unauthorized access.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES legallegal governmentgovernment
Incident Timeline
‎between January 2007
Threat actors accessed and stole records dating back to 1978, specifically targeting data from the UK Legal Aid Agency between January 2007.
‎April 2025
Threat actors breached the UK's Legal Aid Agency's IT systems in April 2025, stealing records dating back to 1978.
target_region United Kingdom
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
organisation The Legal Aid Agency
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
organisation LAA
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
organisation Ministry of Justice
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
organisation Public Defender Service
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978.
‎early May 2025
Hackers stole records dating back to 1978 from the UK Legal Aid Agency.
‎May 2025
The UK Legal Aid Agency's records dating back to 1978 were stolen by hackers, following a breach that was part of a string of cyberattacks targeting other organizations.
organisation GOV
That is why we published information on GOV. UK as quickly as possible and have continued to update it as our understanding of the cyber-attack has developed," a Ministry of Justice spokesperson told BleepingComputer.
organisation BleepingComputer
That is why we published information on GOV. UK as quickly as possible and have continued to update it as our understanding of the cyber-attack has developed," a Ministry of Justice spokesperson told BleepingComputer.
organisation Harrods
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation Marks & Spencer
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation M&S
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation DragonForce
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation National Cyber Security Centre
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation NCSC
" After the LAA breach, which was followed by a string of cyberattacks targeting the Co-op, Harrods, and Marks & Spencer (M&S) UK retail chains ​​​ claimed by the DragonForce ransomware operation , the country's National Cyber Security Centre (NCSC)  published guidance and advised UK organizations to follow it to strengthen their cybersecurity defenses.
organisation Housing Ombudsman Service
This week, the UK Housing Ombudsman Service, a non-departmental public body sponsored by the Ministry of Housing that settles disputes between social housing residents and social landlords in England, disclosed that it is investigating a third-party IT security incident that impacted its case management system.
organisation the Ministry of Housing
This week, the UK Housing Ombudsman Service, a non-departmental public body sponsored by the Ministry of Housing that settles disputes between social housing residents and social landlords in England, disclosed that it is investigating a third-party IT security incident that impacted its case management system.
data_breach 250,000 records
However, we have now confirmed that approximately 250,000 records predate 2007," the agency said .
organisation the Legal Aid Agency's
"Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency's digital systems.
financial £20 attack
"Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency's digital systems.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
financial £200 Entities
We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services.
‎16 May 2025
Threat actors accessed and stole records dating back to 1978 from the UK Legal Aid Agency.
‎2000s
Threat actors stole records from the UK Legal Aid Agency dating back to 1978, with most stolen data originating from the 1990s and 2000s.
‎2026/10/15
Threat actors successfully exploited vulnerabilities to steal sensitive records from the UK Legal Aid Agency dating back to 1978.
organisation Legal Aid Agency
UK Legal Aid Agency: Hackers stole records dating back to 1978.
Tactical Metrics
Metrics
data_breach
250,000
Records
However, we have now confirmed that approximately 250,000 records predate 2007," the agency said .
Metrics
financial
20,000,000
Financial Impact / Stolen Funds
"Prior to the cyber-attack, we had already committed £20 million to stabilising and upgrading the Legal Aid Agency's digital systems.
Metrics
financial
200,000,000
Financial Impact / Stolen Funds
We are now investing more than £200 million in modernising digital services, improving resilience and strengthening cyber security across legal aid services.
Intelligence Sources
BleepingComputer 2026-10-15