Hackers who breached the Legal Aid Agency’s systems may be in possession of surnames and postcodes of suspects interviewed by the police and legal aid providers' banking details, the government has revealed.

Some 18 months after realising its systems had been hacked, the LAA yesterday published details of precisely whose data was potentially stolen and the type of data. For instance, details of suspects who received police station advice or assistance may have had their surname and initial, and postcode, 'exfiltrated'. Data relating to legal aid providers include office locations, bank account number and sort code.

Some 250,000 records affected by the breach pre-date 2007, with a few from before 1990 and the earliest from 1978. Probation data may have also been stolen.

Read more

In a written statement, courts minister Sarah Sackman said: ‘It is important to remember that much of the exfiltrated information was unstructured, fragmented, and incomplete, meaning that, in many instances, the identification of specific individuals will not be straightforward for the criminals who stole it.

‘The nature and amount of information exfiltrated varies considerably between individuals. Being within one of the periods or groups described in our public information does not, of itself, mean that an individual’s information was exfiltrated or, in the event it was, that the hackers exfiltrated every category of data itemised for each individual.’

Sackman said that there was nothing to indicate that the stolen data has been published or shared.

The LAA’s systems were breached in December 2024 – but the LAA only became aware of the cyber attack in April 2025. The LAA’s online portal was taken offline in May 2025 after the Ministry of Justice discovered that legal aid applicants’ personal data dating back to 2010 had been accessed. A few months later, the Ministry of Justice and LAA announced that the breach was bigger than they first thought.