- The Record reports that UK officials now say the Legal Aid Agency breach includes about 250,000 records from before 2007, the earliest from 1978, plus probation data.
- The first public estimate began in 2010. The agency says the data was unstructured and fragmented, which made the breach hard to size.
- Leaders should ask how far back their own sensitive records go, who can say exactly what is stored where, and which legacy systems still hold data.
A breach is measured by what you kept
When a company is breached, the first question is how the attackers got in. The second is how much there was to take. The UK Legal Aid Agency case shows why the second question can matter more.
The agency first said hackers had reached data on people who applied through its online service since 2010. This week, officials said the real reach is older and wider. The Record reports that about 250,000 stolen records predate 2007. The earliest verified one is from 1978.
The lesson here is simple. A breach is only as small as your oldest unexamined data. Records kept for decades become a burden that today's leaders inherit. The people who dealt with the justice system long ago carry the risk.
What officials now say was taken
Justice Minister Sarah Sackman called the incident "significant and complex" in a written statement to Parliament. She said criminals exploited weaknesses in the agency's IT systems. They reached systems holding personal information and copied data out.
The agency says most of the data covers January 2007 to May 16, 2025. Of the older records, nearly all come from the 1990s and 2000s. Only a very small number predate 1990.
The agency adds a caution. Old records do not mean everyone who touched the justice system before 2007 is affected.
The theft also reaches people under probation supervision. Their names, birth dates, nationalities and case numbers were among the items copied.
Why the count kept moving
The attack follows a plain sequence. Attackers find a weakness, use it to get in, locate the data and copy it out. Security teams call the copying step exfiltration. The report does not say which weaknesses were used.
The hard part came afterwards. The agency says much of the stolen material was "unstructured, fragmented, or incomplete." Structured data sits in labelled fields, so software can search it. Unstructured data has no such labels. Analysts must read it to learn whose information it holds.
That is why the estimate grew. As analysts kept working through the files, they found the intrusion had reached further than the early picture. The agency says its earlier statements used the best information it had then.
What was copied differs from case to case. Some files hold National Insurance numbers. Others hold money assessments of defendants and their partners, plus bank and property details. A few include partly masked payment card details.
Names of judges, lawyers and court reporters in Crown Court trials were also taken.
What is still unknown
The attackers said they held records on over 2 million people. They threatened to leak them unless paid. That figure is their claim, and the report does not confirm it. The UK government has long said it will not pay such demands.
Sackman told the House of Commons the department has no sign the data has been published or shared. In May 2025, a ministry spokesperson told Recorded Future News that publication was a question of "when, not if." The view has shifted. The report does not say why.
Sackman said the ministry has tightened login and access controls and upgraded monitoring. It has also started shutting down or walling off riskier old systems. The National Crime Agency, the National Cyber Security Centre and the data regulator, the Information Commissioner's Office, remain involved.
Questions to put to your team
First, ask how far back your sensitive records go, and who approved keeping them. If nobody can answer, the oldest data is the least understood.
Second, ask how fast you could say whose data sits in your messy files. Scanned documents, exports and free-text notes are the hardest to scope after an incident.
Third, ask which legacy systems still hold personal data. Are they retired, isolated or simply forgotten? Fourth, ask whether your first public statement after a breach would be labelled an estimate.
A breach announcement is a snapshot of what you knew that day. The Legal Aid case shows how that snapshot can change once the old data is counted.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
