Legal Aid Agency
CriticalConfirmedPublic sector
The Legal Aid Agency, a UK Ministry of Justice agency that administers legal aid in England and Wales, suffered an intrusion into its digital systems, which the ministry became aware of on 23 April 2025. On 16 May 2025, the investigation established that data on legal aid applicants and providers had been downloaded: contact details, dates of birth, national ID numbers, criminal history, employment status and financial data (contributions, debts, payments). In an update published in October 2026, the agency states that most of the data dates from January 2007 to May 2025, but that around 250,000 records predate 2007, the earliest going back to 1978. According to the ministry, there is currently no evidence that the data has been published. The attackers reportedly claimed 2.1 million items, a figure the ministry has not verified.
These data would allow a malicious third party to impersonate individuals or carry out targeted fraud or blackmail, notably using criminal history and financial details.
- Disclosed on
- May 16, 2025
- Incident dated
- April 23, 2025
- Sector
- Public sector
- Country
- GB
- Cause
- Undisclosed
Exposed data
- Full name
- Email address
- Phone number
- Postal address
- Date of birth
- Customer ID
- Identity document
- Employment data
- Banking data (IBAN, card)
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact