Legal Aid Agency Data Breach: What Applicants Should Know

People who applied for legal aid shared some of the most sensitive facts of their lives. In 2025 a government agency told them that records going back to 2007 were taken.

By Siddharth ShankarUpdated October 11, 2026

Legal aid applications ask for exactly the kind of detail that is most harmful to expose: financial hardship, family circumstances and sometimes criminal history. A breach of that data is not a typical consumer breach.

What happened

GOV.UK reports that the Legal Aid Agency became aware of a cyber attack on its online digital services on April 23, 2025. On May 16, 2025, it found that a group had accessed a large amount of applicant information, and took systems offline. The agency worked with the National Crime Agency and the National Cyber Security Centre and informed the Information Commissioner's Office.

An injunction, added on June 4, 2025, prohibits sharing the data. The notice was updated to July 31, 2025, and corrected an earlier statement that the data went back to 2010.

How it worked

The notice describes unauthorised access to the agency's online digital services. It does not describe the technical method, and we do not guess. The data affected relates to applicants who applied through the digital service from 2007 to May 16, 2025.

What was exposed

The data potentially affected includes contact details, addresses, dates of birth, national ID numbers, criminal history, employment status and financial data such as contributions, debts and payments. Partner information was affected in some cases. Providers' own details, including financial information, may have been compromised too.

Because the notice says "potentially affected," not every field will apply to every person.

How it ended

This case is open-ended and unhappy. The notice reports no arrest and no fine. It does not say who carried out the attack, how many people were affected or whether services have been restored. An injunction is a legal step to prevent sharing, but it cannot guarantee that criminals will comply.

A timeline of the case

The agency became aware of the attack on April 23, 2025. Three weeks later, on May 16, it found a group had accessed a large amount of applicant data and took systems offline. An injunction followed on June 4, and the notice was updated through July 31 to correct the start date of the data from 2010 to 2007.

That correction matters for individuals. It means people who applied between 2007 and 2010 were affected too, and may not have expected it.

Key facts at a glance

• Discovered: April 23, 2025
• Extent found: May 16, 2025
• Applicant data period: 2007 to May 16, 2025
• Data potentially affected: contact details, national ID numbers, criminal history, financial data
• Injunction: added June 4, 2025
• Not stated: number of people, attackers' identity, restoration of services

Why this case matters

Government services collect sensitive data because they have to, and individuals often have no alternative provider. That makes the security of those systems a public issue. The facts here, a long retention period reaching back to 2007, also raise a question of how long such data should be kept.

For people affected, the realistic risk is targeted contact. Someone who knows you applied for legal aid, and what you disclosed, can make a message sound official. Scammers and other criminals sometimes use exactly this kind of knowledge to pressure people, so a cautious attitude to unsolicited contact is the main protection.

What you can do

What the notice does not say

The notice does not describe the number of affected people or the attackers, and it does not say that anyone has been charged. For a private-sector supplier breach in the UK with a fine, see Capita.

If this case made you want to check your own position, start with these guides on what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach. You can also try our free email exposure check.