UK Legal Aid Agency Hack Scope Widens After Forensic Review

In April 2025, the UK Legal Aid Agency experienced a data breach that allowed unauthorized access and exfiltration of personal and case-related data. Forensic review expanded the scope of the breach to include records dating back to 1978, with the majority of compromised data related to applications, claims, and payments from 2007 to 2025. Additional compromised data includes information on legal aid practitioners, judges, solicitors, advocates, and probation service users managed between 2010 and 2017. The breach involved multiple systems and large volumes of unstructured and fragmented data, complicating the investigation. The agency has found no evidence that the stolen data has been publicly disclosed or sold.

The breach exposed sensitive personal information including names, addresses, dates of birth, National Insurance Numbers, case reference numbers, phone numbers, and user credentials. This affects individuals who applied for or received legal aid, legal professionals, judges, and probation service users. The exposure of such data could lead to privacy violations and potential identity theft risks, although no public release or sale of the data has been confirmed.

No specific remediation or patch is applicable as this is a data breach incident involving unauthorized access. The UK Legal Aid Agency has completed forensic investigations to understand the scope and nature of the breach. Organizations should continue to monitor for any misuse of the compromised data and follow guidance from the agency and relevant authorities. There is no indication that further immediate action is required beyond ongoing incident response and monitoring.