---
title: "Data breach at Legal Aid Agency"
description: "The Legal Aid Agency, a UK Ministry of Justice agency that administers legal aid in England and Wales, suffered an intrusion into its digital systems, which the ministry became aware of on 23 April 2025. On 16 May 2025, the investigation established that data on legal aid applicants and providers ha"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2025-05-16-legal-aid-agency
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2025-05-16
dateModified: 2025-05-16
---
# Legal Aid Agency

Data breach — Critical

The Legal Aid Agency, a UK Ministry of Justice agency that administers legal aid in England and Wales, suffered an intrusion into its digital systems, which the ministry became aware of on 23 April 2025. On 16 May 2025, the investigation established that data on legal aid applicants and providers had been downloaded: contact details, dates of birth, national ID numbers, criminal history, employment status and financial data (contributions, debts, payments). In an update published in October 2026, the agency states that most of the data dates from January 2007 to May 2025, but that around 250,000 records predate 2007, the earliest going back to 1978. According to the ministry, there is currently no evidence that the data has been published. The attackers reportedly claimed 2.1 million items, a figure the ministry has not verified.

These data would allow a malicious third party to impersonate individuals or carry out targeted fraud or blackmail, notably using criminal history and financial details.

| Fact | Value |
| --- | --- |
| Disclosed on | May 16, 2025 |
| Incident dated | April 23, 2025 |
| Sector | Public sector |
| Country | GB |
| Cause | Undisclosed |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Email address
- Phone number
- Postal address
- Date of birth
- Customer ID
- Identity document
- Employment data
- Banking data (IBAN, card)
- Other personal data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [UK Legal Aid Agency: Hackers stole records dating back to 1978](https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/) — Bleeping Computer
- [Legal Aid Agency data breach](https://www.gov.uk/government/news/legal-aid-agency-data-breach) — GOV.UK (Ministry of Justice)
- [Cyber attack on Legal Aid Agency exposes 18 years of user data, says Ministry of Justice](https://www.teiss.co.uk/news/cyber-attack-on-legal-aid-agency-exposes-18-years-of-user-data-says-ministry-of-justice-16185) — teiss

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2025-05-16-legal-aid-agency
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees