UK Legal Aid Agency breach reaches back to 1978, far further than first thought
Follow-up analysis of the April hack puts around 250,000 records before 2007, with the oldest from 1978. The Ministry of Justice says nothing has turned up online yet.
Key points
- The UK Legal Aid Agency now says around 250,000 of the stolen records predate 2007, with the earliest dating from 1978, far older than the 2010 cutoff first disclosed.
- Detected in April 2025 and publicly confirmed in early May, the breach exposed sensitive applicant data including names, dates of birth, national ID numbers and criminal history.
- The Ministry of Justice says there's no evidence yet that any of the stolen data has been published online.
- The government has moved from a £20 million stabilisation budget to more than £200 million for legal aid digital and cyber work.
- Threat Vectr's own leak-site tracking of DragonForce's claims is drawn from our coverage since we first reported on the group on 22 July 2026.
The Legal Aid Agency, the Ministry of Justice body that pays for lawyers for people who can't afford one in England and Wales, has told the public its April 2025 breach is older and deeper than first thought. Records taken by the attackers go back as far as 1978.
In its first disclosures in May the agency said data from 2010 onward had been stolen. A fresh review has now pushed that date back by more than three decades.
Around 250,000 records predate 2007, the agency said in an update this week. Most are from the 1990s and 2000s. A fractionally small number sit before 1990, and the oldest confirmed file is from 1978.
One caveat the agency is careful to make: older records being in the dataset doesn't mean everyone who dealt with legal aid before 2007 is caught up in this. It means some were.
What was actually taken?
Sensitive personal data on legal aid applicants and recipients, plus business data on the law firms that work with the agency. Applicant records include names, contact details, dates of birth, national insurance numbers, criminal history and employment status.
On the provider side, covering barristers, solicitor firms and non-profit organisations the LAA contracts, attackers took contracts, office locations, financial details and login credentials for the LAA Online Portal.
The agency employs about 1,250 staff and works with roughly 2,000 provider organisations. It handles billions of pounds in legal funding each year.
Has any of this appeared online?
Not yet, according to the government. A Ministry of Justice spokesperson told BleepingComputer there's currently no evidence that any of the exfiltrated personal data has been published.
That matters because stolen government data usually surfaces in one of two places: a criminal leak site or a private sale on a forum. Neither has happened here, or neither has been spotted.
On spending, the department had already committed £20 million to stabilising the agency's digital systems before the attack. It's now putting more than £200 million into modernising legal aid technology and cyber defences.
Who did it, and how does this fit the wider picture?
The government hasn't publicly named a group for the LAA hack. What followed, though, was a run of attacks on UK retailers Co-op and Marks & Spencer, plus Harrods, all claimed by DragonForce, a ransomware-as-a-service operation that rents its file-locking malware to affiliates in exchange for a cut of any payment.
DragonForce has been one of the busier crews on the English-language extortion scene this year. We first covered the group on 22 July 2026, and on 24 September we reported on Storm-2570, the affiliate Microsoft identified hopping between DragonForce, Qilin and other ransomware crews, a detail that matters here: the LAA attack has not been publicly attributed, and affiliate-hopping makes attribution harder. DragonForce's leak-site claims are posts the group itself makes, not independently confirmed breaches.
| Fact | Figure |
|---|---|
| Earliest stolen record | 1978 |
| Records predating 2007 | ~250,000 |
| LAA staff | ~1,250 |
| Provider organisations | ~2,000 |
| New UK legal aid digital and cyber spend | £200m+ |
Should you be worried if you've ever used legal aid?
Anyone who has applied for or received legal aid in England or Wales should treat unexpected calls, texts or emails referencing their case with suspicion. Don't share bank details or passwords with a caller who claims to be from the LAA or a law firm acting for you. Our earlier story on UK account hijacking fraud is a reminder of how quickly stolen personal data gets turned into social-engineering attacks.
The headline is the 1978 date, but the operationally interesting line is that nothing has leaked. Nine months on from a government breach this size, silence usually means one of three things: a quiet payment, a buyer who wants the data kept off public view, or an attacker who never intended to publish. Which of those it is tells you more about the attackers than the date range does.
