# Legal Aid Agency Data Breach Extends to 1978 Records Government reveals hackers accessed decades of sensitive legal and probation data in 2025 breach. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/53f9fd50-af47-42be-963d-4f0381227633 ## Historical Data Breach Scope The UK Legal Aid Agency confirmed that a 2025 cyberattack resulted in the theft of records dating back to 1978. Initially, the agency estimated the breach only covered data from 2007 onwards. Forensic analysis now reveals that approximately 250,000 records, primarily from the 1990s and 2000s, were compromised during the incident. ## Probation Service Data Exposure Beyond legal aid applications, the Ministry of Justice discovered that hackers accessed HM Prison and Probation Service records. This data includes names, birth dates, nationalities, and case reference numbers for offenders supervised between 2010 and 2017. Officials noted that over 99 percent of this specific data relates to individuals supervised in 2016 and 2017. ## Nature of Compromised Information Stolen files contain highly sensitive personal details, including National Insurance numbers, addresses, and financial information. Some records detail criminal charges, pleas, and convictions. Specifically, information regarding the Very High Cost Cases scheme from 1981 to 2004 was accessed, alongside legal aid benefit assessments spanning from 1978 through to the year 2012. ## Detection and System Disruption The intrusion was first detected on April 23, 2025, but the full scale remained unknown until May 16. The government subsequently took online services offline, causing significant operational disruption for lawyers. These technical problems persisted for months, with a difficult return to service occurring in December, leaving legal providers struggling with ongoing system delays. ## Complexity of Forensic Investigation The Ministry of Justice attributed the delayed discovery to the complexity of the compromised systems. Much of the stolen information was unstructured, fragmented, or incomplete, making identification difficult. Officials stated that increased data identification capabilities eventually allowed them to develop a more complete understanding of the information compromised during the initial April attack. ## Security Posture and Remediation Following the breach, the Ministry of Justice implemented stricter authentication and access controls. Security monitoring has been enhanced, and identified vulnerabilities are being addressed. The agency has begun retiring or isolating higher-risk technology and is currently working to modernize legacy systems that were found to be susceptible to such unauthorized data exfiltration. ## Uncertainty Regarding Data Usage While the government currently has no indication that the stolen information has been published or shared, the risk remains. The agency clarified that the 250,000 figure does not represent a confirmed number of affected individuals. Furthermore, the presence of these historical records does not mean every applicant before 2007 had their personal information stolen. ## Legacy System Governance Risks The breach highlights the persistent danger of maintaining accessible legacy data within government infrastructure. The fact that records dating back to the 1970s remained active in digital systems raises critical questions about data retention policies. This incident underscores the necessity of isolating or purging outdated sensitive information to prevent future large-scale security compromises. ## Sources covering this story - https://www.theregister.com/security/2026/10/15/legal-aid-agency-hackers-made-off-with-records-dating-back-to-1978/5303243 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._