INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

UK Legal Aid Agency Experiencing Wider Scope of Cyber Attack

| 2026-10-15 14:22 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
The UK Legal Aid Agency's records dating back to 1978 were compromised in an April 2025 data breach, with approximately 250,000 of the affected records pre-dating 2007. The hackers accessed and exfiltrated personal information of individuals who applied for legal aid, including names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, and other types of information. This incident is related to a broader cyberattack that also impacted the UK Ministry of Justice agency, which reported in May last year that hackers had accessed personal information of individuals who applied for legal aid. The attackers' data exfiltration also included information pertaining to legal aid practitioners, judges, solicitors, advocates, and probation service users between 2010 and 2017. An extensive investigation by the Forensic Review has identified the scope of the incident, with no evidence that the stolen information has been released publicly or sold.
Technical Mitigations AI-generated
• Patch the LAA's Client and Cost Management System (CCMS) to address potential vulnerabilities. • Implement a more robust incident response plan, including regular forensic reviews of affected systems. • Use threat intelligence tools to detect and block access attempts from known attackers or IP addresses associated with the breach.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES NORDICS NORDICS governmentgovernment
Incident Timeline
‎April 2025
The UK's Legal Aid Agency discovered a data breach in April 2025 that compromised records dating back to at least 1978, including potentially sensitive information of legal aid applicants and recipients.
target_region United Kingdom
The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
tactic Data Breach
The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
ASOS Confirms Cyberattack, Data Breach Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
organisation LAA
The UK’s Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach.
organisation Denmark’s Central Person Register
ASOS Confirms Cyberattack, Data Breach Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
organisation CenterPoint Energy Data Breach
Related: CenterPoint Energy Data Breach Impacts 1 Million Texans Related: iRhythm Data Breach Impacts at Least 360,000 People Related:
organisation iRhythm Data Breach Impacts
Related: CenterPoint Energy Data Breach Impacts 1 Million Texans Related: iRhythm Data Breach Impacts at Least 360,000 People Related:
data_breach 250,000 compromised records
However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.
organisation National Insurance Numbers
Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.
organisation LAA’s Client and Cost Management System
Compromised data associated with legal aid applicants and recipients may include names, addresses, dates of birth, National Insurance Numbers, postcodes, case reference numbers, answers entered into LAA’s Client and Cost Management System (CCMS), phone numbers, and other types of information.
‎2025/10/15
Hackers accessed and exfiltrated the personal information of individuals who applied for legal aid in May last year.
target_region United Kingdom
In May last year , the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not share the full scope of the incident.
organisation the UK Ministry of Justice
In May last year , the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of individuals who applied for legal aid, but did not share the full scope of the incident.
‎2000s
Threat actors used outdated malware to target the UK Legal Aid Agency, with most incidents occurring in the 1990s and 2000s.
‎between 2010 and 2017
Threat actors exfiltrated sensitive personal data, including names and case reference numbers, from Probation Services in the UK between 2010 and 2017.
organisation Probation Services
The data exfiltrated by the attackers includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017,” LAA says.
‎2026/10/15
The UK Legal Aid Agency's scope of the 2026 hack was widened after a forensic review, but no specific details on the nature or extent of this widening were provided.
organisation Legal Aid Agency
UK Legal Aid Agency Hack Scope Widens After Forensic Review.
organisation Forensic Review
UK Legal Aid Agency Hack Scope Widens After Forensic Review.
Tactical Metrics
Metrics
data_breach
250,000
Compromised Records
However, forensic investigators confirmed that approximately 250,000 compromised records predate 2007.
Intelligence Sources
SecurityWeek 2026-10-15