Legal Aid Agency Cyber-Security Incident

Sarah Sackman Excerpts

Wednesday 14th October 2026 Written Statements

[The Minister for Courts and Legal Services (Sarah Sackman)]

In my previous statements to the House, I have provided updates on the 2025 criminal cyber-attack against the Legal Aid Agency’s digital services and the steps that the Ministry of Justice and the Legal Aid Agency have taken in response.

I have been clear throughout that this was a significant and complex incident and that our understanding of the information affected would continue to develop as detailed technical and data analysis progressed. The Government committed from the outset to being transparent with Parliament as that understanding improved.

I am therefore writing to update the House on further information identified through that work.

The cyber-attack happened because criminals were able to exploit vulnerabilities in the LAA’s IT systems and gain access to systems containing personal information. They then copied and exfiltrated some data held by the Department.

Our previous public information stated that the attackers had accessed and exfiltrated a significant amount of personal data relating to people who had applied for legal aid, or interacted with its services, between 2007 and 16 May 2025.

Specialist technical and data teams have continued detailed analysis of the information exfiltrated during the attack. That work has enabled us to develop a more complete understanding of that information, which I outline below.

It remains true that the vast majority of the exfiltrated LAA data dates between 2007 and 16 May 2025. However, we have now confirmed that a small proportion of the affected LAA records predate 2007. The majority of these pre-2007 records date from the 1990s and 2000s, with only a very small number extending further back than this. The earliest record currently verified dates from 1978.

Exfiltrated data from the relevant period varies from person to person but may include basic personal details such as names, addresses and dates of birth, as well as information relating to legal aid applications and cases, including in some instances financial or other sensitive personal information. In some cases, the information is limited to a single document or record about an individual, such as a letter sent by the LAA to an individual or their solicitor about their case, or a record of a payment made. In other cases, more complete information relating to an application or bill submitted to the LAA was affected. However, in no case was a complete record relating to a legal aid case affected.

Our analysis has also established that some information relating to HM Prison and Probation Service—specifically, limited probation data, which our analysis indicates does not include information about victims of crimes—was contained within material exfiltrated during the same cyber-attack.

It is important to emphasise that affected data subjects constitute only a fraction of those who have had interactions with the LAA or HMPPS in the relevant period. The MOJ is working at pace and will, where data allows, be able to identify whether any specific individual’s data was exfiltrated in the cyber-attack.

We are updating the public information on www.gov.uk alongside this statement, to provide more detailed information to help individuals understand the data that was exfiltrated. It is important to remember that much of the exfiltrated information was unstructured, fragmented and incomplete, meaning that in many instances the identification of specific individuals will not be straightforward for the criminals who stole it.

The nature and amount of information exfiltrated varies considerably between individuals. Being within one of the periods or groups described in our public information does not, of itself, mean that an individual’s information was exfiltrated or, in the event that it was, that the hackers exfiltrated every category of data itemised for each individual.

We have provided the Information Commissioner’s Office with an update on the exfiltrated information and continue to co-operate fully with it.

As I reported to the House in January, substantial work has taken place since the criminal cyber-attack on the LAA to restore services safely and to strengthen the resilience of its technology. The Department’s objective is not simply to recover from the attack, but to emerge stronger, more resilient and better prepared for the future. We have allocated £200 million for transformation, recovery, and moving legacy systems to a modern and safe technology platform. We are also strengthening security monitoring, technical checks and the way risks are managed, to make LAA services more secure and resilient in future.

Finally, but importantly, we have no indication that the stolen data has been published or shared.

I recognise the concern that this incident has caused, particularly given the sensitive circumstances in which many people engage with the legal aid system. We will continue to be transparent as our work progresses and will ensure that the public information available reflects our best and most accurate understanding of the incident.

[HCWS376]