Legal Aid Agency hack took far more data than thought, with records from 1978

[Shannon98]

The Ministry of Justice has revealed that the April 2025 hack of the Legal Aid Agency stole much more data than first reported. The Register's Carly Page reports that around 250,000 records from before 2007 were taken, the oldest dating back to 1978. The agency had originally said the stolen data started in 2007

The older records include legal aid benefit assessments from 1978 to 2012 and payment records for very high cost cases from 1981 to 2004. The hackers also reached prison and probation data, including names, dates of birth, nationalities and case reference numbers for offenders supervised between 2010 and 2017. More than 99 percent of that data covers 2016 and 2017, and none of it relates to victims of crime

Depending on the person, the records may include addresses, National Insurance numbers, financial details, and criminal charges, convictions and sentences. The government stresses that 250,000 is not a confirmed number of affected people, and it has seen no sign that the data has been published

The ministry blamed the long delay in identifying all this on data spread across messy, fragmented systems. The Register points out that the update does not explain why records from the 1970s were still accessible at all. That is a fair question, because data that no longer needs to be kept should not be sitting on connected systems

For anyone who received legal aid over the decades, this is worrying news, and it is important to watch out for scams that use personal details. The lesson for every organisation is clear. Old data is a liability, and deleting what you no longer need is one of the simplest ways to limit the damage from a breach

Should organisations be required to delete old records after a fixed period? And how worried should people who received legal aid be?

Legal Aid Agency hackers made off with records dating back to 1978www.theregister.com