Hackers breached the UK Legal Aid Agency, exposing records back to 1978

The Legal Aid Agency breach revealed records reaching back to 1978, with roughly 250,000 of them originating before 2007, and it also exposed probation information for offenders supervised between 2010 and 2017—such as names, dates of birth, nationalities and case reference numbers for a limited group—over 99 % of which date from 2016‑2017.

Attackers accessed provider information such as contracts, office addresses, financial details, contact details and credentials for the LAA Online Portal, including names and email addresses. The compromised data could contain names, addresses, dates of birth and financial or other sensitive details tied to legal aid applications and case files.

The Ministry of Justice has set aside £200 million to transform, recover and shift legacy systems onto a modern, secure technology platform. Before the breach, the government had earmarked £20 million to stabilise and upgrade the Legal Aid Agency’s digital infrastructure and is now directing over £200 million toward modernising and securing legal aid services.

“We have allocated £200m for transformation, recovery, and moving legacy systems to a modern and safe technology platform,” Sackman added.

Sarah Sackman, Civil Service World

A Ministry of Justice spokesperson stated that no evidence shows anyone has published the stolen personal data. The UK government announced a new cybersecurity strategy backed by more than £210 million in funding.

Law firms representing low‑income clients have been forced to work without pay or to refuse new cases because the Legal Aid Agency’s online portal was taken offline. Payment backlogs have arisen and the agency expects to clear bills for civil representation and crown court work by the end of the month.

The Law Society had urged upgrades to the Legal Aid Agency’s IT systems in 2023 and again in 2024. Labour took control of the UK government in July 2024 after 14 years of Conservative rule.

Some members of Parliament criticised the government’s response as inadequate and called for urgent replacement of outdated IT infrastructure. Liberal Democrat MP William Wallace said raising investment to replace legacy systems is sensible given the high cost of successful cyberattacks. Liberal Democrat Lord Jonathan Marks called on the government to assess how effectively its IT systems can ensure a high level of data security.

The Government Audit Office blamed legacy systems for the failure to meet a target to upgrade cyber defences of critical functions by this year. A Ministry of Justice spokesperson noted that efforts to replace outdated systems began when Labour took office and include a £20 million pledge to modernise the Legal Aid Agency’s digital services.

"Outdated government IT systems are riddled with security holes, lacking critical updates and patches," said Dray Agha, security operations manager at Huntress.

Dray Agha, BnkInfoSecurity

The government is advancing a proposed Cyber Security and Resilience Bill, which is UK legislation designed to mandate patching for critical‑infrastructure operators. The bill would require compulsory patching for operators of critical infrastructure. The Legal Aid Agency breach happened at the same time as a wave of cyberattacks on UK firms that the DragonForce ransomware group has linked to its campaigns. The National Cyber Security Centre has published advice for organisations looking to bolster their defences against these threats. The UK Housing Ombudsman Service reported a third‑party IT security incident that affected its case management system.