Summary

  • A 14 October update says about 250,000 Legal Aid Agency records in the exfiltrated material predate 2007; the earliest currently verified record dates from 1978.
  • The expanded scope includes limited probation data held in material taken during the LAA incident, but neither a date range nor a service group identifies an individual whose data was taken.

The date 1978 is a boundary in the evidence now assembled, not a count of people exposed. The Ministry of Justice says its continuing analysis found around 250,000 Legal Aid Agency records created before 2007 and verified one record from 1978. The attack was identified on 23 April 2025; the Government learned on 16 May that it was more extensive than first understood. The 14 October 2026 update changes the public description after another year of technical and data work. It does not say that every record from those years was taken or that every person who dealt with legal aid then was affected. The Written Ministerial Statement and the accompanying public update make that distinction explicit.

The difference between a record and a person matters here. A record might be a payment, a letter, a claim or a fragment from a case-management system. The government says information varies by individual and that no complete record relating to a legal-aid case was affected. Its tables say some fragments may contain names, addresses, dates of birth, national identifiers, financial information or details about a case. They do not say that every listed field was present for every person. The archived Legal Aid Agency incident FAQs had previously described the known applicant range as 2007 to 16 May 2025. That was a dated assessment, not a promise that older material could not later be found.

The update also changes the service boundary in the public record. It says limited HM Prison and Probation Service information, specifically probation data, was present in material exfiltrated during the same incident. The statement describes a relatively small group of people managed by Probation Services between 2010 and 2017; more than 99% of that subset relates to 2016 and 2017. This is evidence about data found in the material taken from Legal Aid Agency systems. It is not evidence that HMPPS systems were breached. Nor does the Government give a person count for that subset. The LAA update says the listed HMPPS information does not concern crime victims.

That limit helps explain why the update is more than a longer date range. The Ministry of Justice says much of the exfiltrated information is fragmented, unstructured and incomplete. It says the conditions may make it harder for the people who stole it to identify individuals, while also warning readers that being in a time period or service group does not show that a particular person’s records were taken. It reports no indication that the stolen data has been published or shared. “No indication” is a statement about what authorities know now; it is not proof that the data could never circulate.

The control history adds another clock. In June, the Government said cyber and digital risks had appeared on the Legal Aid Agency and Ministry of Justice risk registers since 2021. It described the LAA’s 2022–23 infrastructure assessment as the most complex and fragile in the department. The same answer says £10.5 million of 2024–25 investment introduced monitoring and alerting that, in the Government’s view, enabled the attack to be detected when it was. It also says legacy exposure remained high. Those are the Government’s stated assessments, not an independent causal finding about this incident. The parliamentary answer on detection and system risk gives the chronology.

Two financial reports show why breach scoping and system recovery need separate proof. The LAA’s 2024–25 accountability report records that its earlier assessment believed the breach was contained to LAA systems and that services had to be run through contingency arrangements. The later probation finding concerns information in the exfiltrated material; it does not by itself establish an HMPPS system intrusion. Separately, the Comptroller and Auditor General examined incident controls, data integrity and payments used in the Ministry of Justice’s accounts and found no material misstatements. That audit finding is assurance about financial statements. It does not certify that every person whose information was taken has been identified.

The measure that matters next

The public record now spans decades, but the Government has not published a count of affected people, a count of people it can identify, or a timetable for completing person-level checks. It says it will identify individuals where the data allows. That conditional wording is the most consequential part of the update: a large record inventory does not automatically become a reliable notification list. The next meaningful evidence would show how the agency links records to people, where that linkage remains uncertain, which groups have been contacted and how unresolved cases will be revisited.