The government has disclosed further details about personal and financial information that may have been stolen during a cyber attack on the Legal Aid Agency (LAA), including records relating to people who received criminal legal aid, legal aid providers and some individuals supervised by probation services.
The updated information, published on 14 October 2026, provides a clearer picture of the types of records potentially accessed by hackers. These may include surnames, initials and postcodes associated with people who received legal advice at police stations, as well as banking information belonging to legal aid providers.
The government has stressed that the information affected varies between individuals. Inclusion within a potentially affected category does not necessarily mean that a person’s data was stolen, or that every type of information listed for that category was compromised.
Information relating to people who received advice or assistance at police stations may have included their surname, initial and postcode, together with details such as case dates, costs claimed and codes indicating the type of legal aid received.
Information held about legal aid providers may also have been compromised. This could include office locations, payment records, contact details and banking information, including account numbers and sort codes.
According to the government’s latest disclosure, approximately 250,000 records in the material date from before 2007. Some records date from before 1990, with the earliest identified record dating back to 1978.
The disclosure does not mean that everyone who received legal aid or interacted with the justice system during those years has been affected. Authorities have cautioned that the available information is incomplete in some cases and that the categories of data potentially accessed differ considerably.
Further analysis has also identified information relating to some users of HM Prison and Probation Service within the material taken during the attack. The government said the data included certain names, dates of birth, nationalities and case reference numbers relating to a relatively small number of offenders who were actively managed by probation services between 2010 and 2017. More than 99% of the relevant probation records related to individuals under supervision during 2016 and 2017.
The update stated that none of this probation data related to victims of crime.
Courts Minister Sarah Sackman said much of the information obtained by the attackers was fragmented, unstructured or incomplete. This could make it difficult for criminals to identify specific individuals from the material.
She emphasised that being part of a group identified in the government’s update does not establish that a person’s information was taken. Even where data was accessed, not every category of information listed for that group would necessarily have been included.
The minister added that the government had no indication that the stolen information had been published or shared.
The breach began in December 2024, but the LAA became aware of the cyber attack in April 2025. The agency’s online services were taken offline in May 2025 after the Ministry of Justice discovered that personal data relating to legal aid applicants had been accessed. Further investigations subsequently established that the incident was more extensive than initially understood.
Since the breach, technical specialists have continued to analyse the affected systems and records to establish the nature and potential scope of the compromised information. The latest disclosure reflects the results of that further analysis.
The Ministry of Justice and the LAA have continued work to strengthen system security, including improvements to authentication and access controls, security monitoring and the management of vulnerable technology.
Anyone who believes they may be affected should remain alert to suspicious emails, messages and telephone calls. Individuals should be cautious about unexpected requests for personal or financial information, independently verify the identity of anyone requesting sensitive details and avoid reusing passwords across accounts.
The latest update provides additional transparency about the incident, but it does not establish that every person within the identified groups has suffered a data breach. The government has said it will continue to review the available information and update its public guidance as necessary.
