ADMIN 
The UK Legal Aid Agency has published a further update about the 2025 cyberattack on its digital services, saying investigators now have a more complete picture of information attackers may have accessed. The October 2026 notice adds detail about data connected with legal aid applicants, recipients and some people managed by probation services.
The update is important for anyone who used legal aid or interacted with the relevant services during the periods listed by the government. It does not mean every person in those groups had data stolen. The agency says the affected information varies by person and that it has no indication the stolen data has been published or shared.
What happened
The Legal Aid Agency says it identified the cyberattack on 23 April 2025. In May of that year, it established that the intrusion was more extensive than first understood and that a criminal group had accessed and extracted a significant amount of personal data. The Ministry of Justice and the agency say the investigation has been complicated by large volumes of fragmented and incomplete records.
The October update reflects additional analysis. It lists categories of people, time periods and kinds of information that could be involved. The data potentially affected includes names, dates of birth, postcodes, National Insurance numbers, case references, legal-aid case details, payments and some correspondence. The exact fields depend on the person and the type of interaction.
The notice also says information relating to a relatively small number of probation-service users was accessed. It includes some names, dates of birth, nationalities and case references for people actively managed between 2010 and 2017, with more than 99% of that data relating to supervision in 2016 and 2017.
What the date ranges mean
The dates differ by group. For example, the update says data associated with civil legal help or mediation claims submitted between January 2000 and May 2025 may include certain identifying and case information. Some criminal legal-aid categories cover applications or cases over different date ranges. The agency also lists information tied to debt-management activity and payments made between 2019 and 2025.
These are investigation ranges, not a notice that every person in those periods was affected. The agency explicitly cautions that receipt of legal aid, an application, or contact with probation services does not by itself prove an individual’s information was in the extracted data. People should consult the official notice and its FAQs rather than infer exposure from a date alone.
What affected people can do
The agency recommends staying alert to unexpected emails, calls and messages; being cautious about requests for personal or financial information; independently checking the identity of anyone asking for sensitive details; and using strong, unique passwords. Do not provide an unsolicited caller with a password, verification code or banking detail. If someone contacts you claiming to be from a government agency, use contact details published on the official GOV.UK website to verify the request.
If you are concerned that information may relate to you, read the official update and FAQ. The Legal Aid Agency publishes a customer-services number for incident-related questions: 0300 200 20 20, 9 a.m. to 5 p.m. Monday to Friday. Case-specific queries should go through the agency’s usual channels. Do not rely on contact details in an unexpected message.
What the government says about the response
The Ministry of Justice and the agency say they have strengthened authentication and access controls, improved security monitoring, addressed vulnerabilities, isolated or retired higher-risk technology and begun longer-term work to modernize legacy systems. They continue to work with the National Cyber Security Centre and other partners.
Those are the agency’s reported response steps; they do not remove the need for individuals to be cautious. Nor does the current notice establish that information has been used for fraud. The agency says it has no indication the data has been published or shared.
Frequently asked questions
Does the update confirm my information was stolen?
No. The agency says the date ranges and data types describe what could have been affected. They do not prove that each person in a category had information extracted.
Has the data been published online?
The agency says it has no indication the stolen data has been published or shared.
Should I change my passwords?
Use strong, unique passwords and change any password that you reused or believe may be exposed. Do not follow password-reset links in unsolicited messages; go directly to the service’s official site.
The agency says it will keep the notice under review. Readers should rely on its latest GOV.UK update for any new dates, categories or advice.
Sources: Official October update; incident information hub; NCSC data-breach guidance
