Hackers stole records dating back almost 50 years in legal aid cyber attack

Hackers obtained records stretching back as far as 1978 during a cyber attack on the legal aid system last year, a justice minister has stated.

The Ministry of Justice (MoJ) previously disclosed that a "significant amount of personal data" relating to applicants to the Legal Aid Agency (LAA) from 2007, including criminal records, was accessed and downloaded in the breach.

However, findings revealed on Wednesday show the compromised data dates back considerably further than previously understood.

Courts and legal services minister Sarah Sackman told the Commons in a written statement: “The cyber attack happened because criminals were able to exploit vulnerabilities in the LAA’s IT systems and gain access to systems containing personal information.

“They then copied and exfiltrated some data held by the Department (MoJ).

“Specialist technical and data teams have continued detailed analysis of the information exfiltrated during the attack.

“It remains true that the vast majority of the exfiltrated LAA data dates between 2007 and 16 May 2025.

“However, we have now confirmed that a small proportion of the affected LAA records predate 2007.

“The majority of these pre-2007 records date from the 1990s and 2000s, with only a very small number extending further back than this.

“The earliest record currently verified dates from 1978.”

Data taken may include “basic personal details such as names, addresses and dates of birth, as well as information relating to legal aid applications and cases, including in some instances financial or other sensitive personal information”.

But “in no case was a complete record relating to a legal aid case affected”, she said, while also confirming “limited probation data” held by HM Prison and Probation Service (HMPPS) was also hacked but this did not include information about victims of crime.

“The MoJ is working at pace and will, where data allows, be able to identify whether any specific individual’s data was exfiltrated in the cyber attack”, she added.

The Government became aware of the hack in April 2025 but realised a month later that it was more extensive than originally thought and took the system offline, prompting reports this caused havoc in the courts with some cases facing delays as a result.

The cyber attack was carried out by people claiming to be part of a “known hacking group”, the High Court heard at the time as Government lawyers successfully sought an injunction which required the people “threatening to disclose information wrongly extracted” from the LAA’s IT systems to identify themselves and hand over the information without publishing it.

Ms Sackman said: “We have no indication that the stolen data has been published or shared.

“I recognise the concern that this incident has caused, particularly given the sensitive circumstances in which many people engage with the legal aid system.”

She stressed the “identification of specific individuals will not be straightforward for the criminals who stole it” and “substantial work” has taken place since the attack to “restore services safely and strengthen the resilience of the Legal Aid Agency’s technology”.