On 14 October 2026, the Legal Aid Agency confirmed that around 250,000 stolen records predate 2007.
Hackers gained access in December 2024, but the agency did not detect the intrusion until 23 April 2025.
By 16 May 2025, the agency knew significant amounts of personal data had been stolen but it was still identifying the extent of the theft in October 2026.
The government has confirmed that the stolen data includes records containing:
- Names
- Addresses
- Dates of birth
- National Insurance numbers
- Financial assessments
- Details of legal proceedings
- Bank details
- Probation records
The agency says it has no indication that the stolen information has been published or shared.
Andy Burnham cancelled the proposed national Digital ID scheme in July 2026, but the government is continuing to expand http://GOV.UK One Login.
The Legal Aid Agency breach demonstrates the risks of retaining personal information for decades and the consequences when government systems fail to protect it.
We have seen repeated examples of government data security failures, reinforcing the need for independent scrutiny of who can access our personal information, how long it is retained and how securely it is stored.
The closure of One Login's independent privacy and inclusion advisory group in 2025 is particularly concerning given the government's record on data security.
Stolen personal information can lead to blackmail, targeted crime and physical harm and the government is asking us to trust it with more of our identity information.
Who is holding the government accountable and what happens when the next breach occurs?
Sources:
https://www.gov.uk/government/news/legal-aid-agency-cyber-security-incident-data-update-october-2026
https://questions-statements.parliament.uk/written-statements/detail/2026-10-14/hcws376
