The Ministry of Justice's Legal Aid Agency was breached in April 2025. This week it told the public that the picture it gave then, and again over the summer, was too narrow. In its data update of 14 October, the agency says that roughly 250,000 of the affected records pre-date 2007, that the oldest verified one goes back to 1978, and that some probation service data was in the same haul.
What the agency now says
The attack was spotted on 23 April 2025, and on 16 May the agency found that a significant amount of personal data had been accessed and taken. Most of what was taken relates to applications, claims or payments made between January 2007 and 16 May 2025, or to cases that were live then. The new part is the tail: most of the older records come from the 1990s and 2000s, and only a very small number pre-date 1990.
The categories are broad, and they vary by person. Depending on who you are, they include names, dates of birth, National Insurance numbers, postcodes and case costs; for Crown Court funding records, offences, pleas, convictions and sentences; for legal aid practitioners, bank account names, numbers and sort codes plus portal usernames. Passported-benefit records run from 1978 to 2012. Separately, a relatively small number of offenders managed by probation between 2010 and 2017 (over 99% of them supervised in 2016 and 2017) had their names, dates of birth, nationalities and case reference numbers taken. The agency says none of the probation data concerns victims of crime, and that it has no indication the stolen data has been published or shared.
That last statement sits awkwardly with the earlier reporting. Canadian Lawyer carried the claim that the criminals behind the attack had threatened to leak the records, and a potential group action was reported by The Lawyer. The agency's wording is careful: no indication of publication, not a statement that it will not happen.
Why the old data is the interesting bit
Anyone who has run a data migration knows the pattern. A system built in the 2000s gets replaced, but the history is carried across because someone might need it, and nobody writes down who. Decades later it is sitting in a modern portal with modern access paths and a 1978 record at the bottom of the table. Nobody chose to keep it exposed. Nobody chose to delete it either.
The cost of that indecision is now measurable: a quarter of a million extra people whose records have to be found, assessed and notified, many of whom have moved house several times since. Address data that old is a poor basis for a letter.
What to take from it, whatever your sector
- Find the oldest record in each of your customer-facing systems. If you cannot say how old it is, you cannot say whether you are entitled to still hold it.
- Check each retention rule against the actual data, not the policy document. Policies rarely fail on paper.
- Treat legacy data as a separate risk class when you plan a migration. Either it has a documented reason to move, or it goes to a cheaper, locked-down archive with far fewer people able to reach it.
- Look at who holds bank details of suppliers and practitioners. They are as sensitive as customer data and are usually stored with less care.
- Rehearse the "scope grew" conversation. The first notification is rarely the last, and the second one is harder if the first claimed more certainty than the evidence allowed.
The practical advice for people who deal with the agency is the standard set: be wary of unexpected calls, emails and texts that mention your case, check who is really asking, and do not reuse passwords. The agency's customer line is 0300 200 20 20. If you want help reviewing what your organisation still holds and why, write to sales@halfteck.com.