The UK’s Legal Aid Agency lost records that stretch back almost fifty years, the government has now admitted, a haul far wider than the one it first described. Hackers broke into the agency and carried off files covering eras officials had believed were untouched.
One stolen record reaches back to 1978, and roughly 250,000 of them predate 2007. Earlier disclosures had pointed only to material from 2007 onward, including applications, claims and payments. The bulk of what has just been identified belongs to the two decades that followed 1990, and hardly any of it was written before that marker.
A second revelation emerged from the same review. Investigators at the Ministry of Justice discovered that intruders had also reached data held by HM Prison and Probation Service. Names, dates of birth, nationalities and case reference numbers of offenders supervised from 2010 to 2017 were exposed, though officials describe that group as relatively small and say more than 99 percent of it covers people under supervision in 2016 and 2017. No information about victims of crime was caught up, the government stressed.
Detection came on April 23, 2025, but the full scale was not established until May 16. Online services were then taken offline, leaving lawyers unable to file claims, and the December return to service brought fresh delays and technical trouble.
What the update leaves unaddressed is why records going back to the 1970s were still reachable and still held. Personal data outlives its operational purpose inside government systems, which is how a single breach can pull in history from a different era entirely.
