The UK's Legal Aid Agency has updated its account of a cyberattack first detected in April 2025. After a detailed review of the material taken, the agency says approximately 250,000 exfiltrated records predate 2007, and the earliest record it has verified dates to 1978. The new finding describes the age of records, not a newly disclosed count of affected people. In its October 14 statement, the agency warns that the presence of older files does not mean everyone who received legal aid before 2007 was affected.
What the new analysis found
The agency identified the attack on April 23, 2025. In May that year, it established that the attackers had accessed and exfiltrated a significant amount of personal data relating to applicants and providers. Since then, investigators have worked through fragmented and unstructured material to determine which records were taken. Most of the Legal Aid Agency data relates to applications, claims, or payments between January 2007 and May 2025, or cases active in that period. The newly identified pre-2007 material is mostly from the 1990s and 2000s; only a very small share dates from before 1990.
The review also found some information relating to people managed by the HM Prison and Probation Service in the stolen material. The agency says this subset concerns probation data, including some names, dates of birth, nationalities, and case reference numbers, and does not relate to victims of crime. The amount and type of information differs by person and record. It would be misleading to assume that every field listed in the agency's tables was exposed for every individual.
What the date range does, and does not, mean
An old record can remain in a modern system because a case, payment, benefit assessment, or correspondence must be retained for administrative reasons. The Legal Aid Agency's updated tables identify several categories that may be relevant, including details of legal aid claims, financial information, case references, and some historical benefit assessments. People who used legal aid within one of the listed periods cannot determine from the date alone whether their own data was exfiltrated. The agency explicitly asks readers not to treat its category tables as a list of confirmed fields for every affected person.
The agency says it has no indication that the stolen information has been published or shared. That statement does not reverse the confirmed exfiltration, and it does not prove that the data cannot be misused privately. The agency recommends caution with unexpected requests for personal or financial information and independent verification of anyone seeking sensitive details. It says it has strengthened authentication, monitoring, and access controls while continuing to work with UK authorities.
The main change in this update is precision: the breach was already known, but the government now has a clearer picture of the stolen material's age and of the limited probation data it contained. Keeping records and people separate is essential to understanding the scale of the disclosure.