Legal Aid Agency hackers made off with records dating back to 1978 – The Register

TOPICS
security
Nearly 50 years of data caught up in breach, with probation service records also among the haul
Hackers who broke into the UK’s Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought.
The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978. That’s much further back than the agency previously estimated ­­– it initially said the stolen data covered legal aid applications, claims, and payments from 2007.
Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990. Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking.
That wasn’t the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017.
The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime.
The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information.
The agency first detected the intrusion on April 23, 2025, but officials didn’t establish the scale of the compromise until May 16. The government subsequently took the LAA’s online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases.
The disruption dragged on for months, with the agency’s troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems.
Further forensic work has now revealed that the data theft goes back much further than officials originally believed.
The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences.
Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004.
The government cautioned that the presence of historical records doesn’t mean that everyone who applied for legal aid before 2007 had their information stolen, nor does the 250,000 figure represent a confirmed number of affected individuals.
Explaining why it has taken so long to pin down the extent of the theft, the MoJ said the attackers stole information spread across several complex systems, much of it unstructured, fragmented, or incomplete.
“Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised,” the agency said.
The government says it has no indication that the stolen information has been published or shared, although that offers little certainty to anyone whose personal details may now be in criminal hands.
Since the attack, the MoJ says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology. Work to modernize its legacy systems is also underway.
The question of why records stretching back to the 1970s remained accessible in the first place is one the latest update does not answer. ®
ChatGPT maker turns tables in Apple’s trade secrets lawsuit, claiming confidential hardware plans made their way back to Cupertino
Nearly 50 years of data caught up in breach, with probation service records also among the haul
PARTNER CONTENT: VergeIO says an exit is also an opportunity
The term military intelligence seems like an oxymoron in this case
New models arrive so fast, we already have more new tech than it’s possible to understand in a career
Four firms believe server farms on barges in ports will help solve the problem of finding suitable sites
Torvalds says contributors must understand their code, whatever tools they use
What are they puffing? Tobacco, apparently. Cancer researcher tells El Reg it’s a bad bet
If you thought 1.6 Tbps was fast, just wait, Cisco’s USFP targets 12.8 Tbps in a single optical pluggable
Anthropic took more than two months to alert cops
Meanwhile, AI agents move robotic arms, ‘make OT device operator screens lie’
Security
PLUS: US takes down Iranian propaganda sites; Marketing company asks ‘Why Do We Have Your Information?’ And more!
Security
PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
Black Hat and DEF CON
Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
Security
Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
Malware Month
On the plus side, infosec’s a good bet for a long, stable career
Increasing awareness and adoption, followed by increasing donations
Persistent agents appeal to AI companies, but demand isn’t obvious
GNOME 51 is here, and Ubuntu interim releases are getting interesting again
All this, and angry NeoVim users
Yet another new version of Firefox, with a significant reskin
Akademy talk imagines Plasma assembling itself around a personal model of each user

Biting the hand that feeds IT
Contact us
Advertise with us
Who we are
Newsletter
The Next Platform
DevClass
Blocks and Files
Situation Publishing
Cookies Policy
Privacy Policy
Ts & Cs
Do not share my personal information
Your Consent Options
Copyright. All rights reserved © 1998-2026.

source
This is a newsfeed from leading technology publications. No additional editorial review has been performed before posting.