Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

The stated start moved back 32 years in 513 days, and the count of people did not appear

The Legal Aid Agency's public notice of 19 May 2025 put the start of the data taken in its breach at 2010. On 31 July 2025 the agency moved it to 2007. On 14 October 2026 it said that approximately 250,000 records pre-date 2007 and that the earliest record it has verified dates from 1978. That is 32 years between the first stated start and the earliest verified record (derived), and 513 days from the first notice to this update (derived). The wording is in the agency's data update, published on GOV.UK on 14 October 2026.

What the update does not establish is longer than what it does. It gives no total number of records, so the 250,000 cannot be placed as a share of anything. It gives no count of people, in the pre-2007 tranche or overall. It does not say whether those people have been told, what categories the old records hold, why records of that age were still online, which system held them, or what the regulator has done. It says only that the presence of old records "does not mean" everyone who dealt with legal aid before 2007 was affected, which is true and leaves the question open.

One correction to the news framing. BleepingComputer's report of 15 October says the attackers breached the agency's systems in April 2025 and recaps stolen applicant data "from 2010 onward". Neither holds on the agency's own record. The agency became aware of the attack on 23 April 2025, but told the Public Accounts Committee that the attacker's first known entry was 31 December 2024, 113 days earlier (derived), and its annual report says data was exfiltrated from January 2025. The 2010 start was replaced on 31 July 2025, about 14 months before this story (derived). April 2025 is the date of discovery, not of the breach.

A note on interest: the Legal Aid Agency and its parent department, the Ministry of Justice, which is the data controller, are writing about their own failure and chose the wording, the order of facts and the timing. This briefing reads the agency's and the Ministry's own pages, the courts minister's written statement of the same day, committee evidence and correspondence, the regulator's own pages, and the policy and law that apply, from 09:15 BST on Thursday 15 October 2026. News coverage is used as a pointer. Nothing was filled in or submitted.

Three statements, one window that kept moving

The table sets each public statement of the start of the data against what changed. The 19 May 2025 wording was read from an archived capture of the notice taken on 20 May 2025, and agrees with the agency's change note and with its letter to a parliamentary committee on the same day.

What the agency and the Ministry of Justice stated about the start of the exfiltrated data, in date order. Sources: GOV.UK notice and its archived captures, annual report, committee evidence, GOV.UK data update and written statement.

Date and where	What was stated about the start	What changed
19 May 2025: GOV.UK notice published at 08:15, and a letter to a committee that day	Applicants "since 2010", to 16 May 2025 when the systems were taken offline.	First statement, worded as belief: "We believe the group has accessed and downloaded a significant amount of personal data".
31 July 2025: the same notice updated	"between 2007 and 16 May 2025", and information linked to partners of applicants.	Change note: "Previously we stated the data went back to 2010." Three years earlier (derived), 73 days after the notice (derived).
16 October 2025 (annual report) and 23 October 2025 (Public Accounts Committee)	2007 repeated. The agency told the Committee it could not give a count of the unique people affected.	No change to the start. The attacker's first known entry given as 31 December 2024.
14 October 2026: GOV.UK data update and written ministerial statement	Vast majority between January 2007 and 16 May 2025. Approximately 250,000 records pre-date 2007. Earliest verified record 1978. Probation data added.	29 years earlier than 2007 (derived), 440 days after the last change (derived). The update says better capability to identify data changed the picture.

The diagram draws the three starts to scale, with the pre-2007 tranche split as the update words it. The bars are years, not record counts: the agency does not say how many of the 250,000 sit in any year.

A smaller point with a practical cost. As at 11:36 BST on 15 October 2026, the original notice shows "Last updated: 31 July 2025", still says 2007, and carries no link to the October update. The agency's main incident page does link to it. A person who found the notice in 2025 and bookmarked it is reading a superseded start date, and nothing on the page says so.

What the 250,000 sits inside

The update's wording has three parts. "The vast majority of the LAA data relates to applications, claims or payments", it says, submitted between January 2007 and 16 May 2025 or in cases live in that period. "However, we have now confirmed that approximately 250,000 records predate 2007." And: "The overwhelming majority of these are from the 1990s and 2000s", with "only a fractionally small number" before 1990 and the earliest verified record from 1978. The written statement made the same day puts it differently: "a small proportion" of the affected records pre-date 2007, with "only a very small number" further back. The letter to the Justice Committee enclosing it repeats "a small proportion". Three phrases for one tranche, and none is a number except the 250,000.

No total is stated, so the share the 250,000 represent cannot be computed from a stated figure, and this briefing does not compute one. An assumption shows why the question matters. If "vast majority" meant at least 90 per cent of records, which the agency does not say, the pre-2007 tranche would be at most 10 per cent and the total at least 2.5 million records (derived under that assumption). At 80 per cent the total would be at least 1.25 million, and at 95 per cent at least 5 million (both derived under the stated assumption). The only other total in circulation is the attackers' own claim of 2.1 million "pieces of data", reported in May 2025, which LBC said the ministry had not verified. It is a claim, in a different unit, and it is not used here.

A record is not a person. The agency's chief executive told the Public Accounts Committee on 23 October 2025 that the data sits across "48 different systems and 120 different components", appears as transactions rather than whole case files, and is often coded. The same chief executive wrote, in a letter of 30 July 2026, that "any estimate is more likely to overstate than understate the number of unique individuals affected", because records that cannot be matched must be treated as separate people. That points one way (inference): a count of unique people is likely to come out lower than the count of records it is drawn from, and the agency itself expects any estimate to err on the high side.

The update's own table of groups gives a narrower view. It lists 15 groups of applicants and recipients and three groups of other people connected with cases, each with a stated window of dates. Three of the 15 windows start before 2007 (derived count: 20 per cent): civil legal help or mediation claims from January 2000, payments in very high cost criminal cases from 1981 to 2004, and benefit status assessments for civil legal aid applicants from 1978 to 2012. The only 1978 in that table is the benefit status window. The agency does not say the earliest verified record belongs to that group, and this match is an inference. The table also states that two rows, debt management and payments by individuals, run to December 2025. That is 7.5 months after the 16 May 2025 end of the window (derived) and after systems were taken offline. The update does not explain it.

The agency's note on the table is worth reading as written. It says the tables "should not be read as meaning that every individual within a particular group had all, or any, of the information listed exfiltrated". A group's window and a person's exposure are different things. The ministerial statement adds that, in no case, was a complete record relating to a legal aid case affected, and that affected people are "only a fraction" of those who dealt with the agency. No fraction is given.

A second dataset in the same update: probation service data

Section added at 12:33 BST on 15 October 2026. The first version of this briefing carried the probation data only as a table cell. The Register reported it the same day, and it deserves its own section.

The agency's 14 October update says its analysis "has also established that some information relating to HM Prison and Probation Service (HMPPS), specifically probation data, was contained within material exfiltrated during the same cyber-attack", and that none of it relates to victims of crime. Its data FAQ says the data "includes some names, dates of birth, nationalities, and case reference numbers for a relatively small number of offenders who were being actively managed by Probation Services between 2010 and 2017", and that "more than 99%" of the data in question related to offenders under supervision in 2016 and 2017. It repeats that it has no indication the stolen data has been published or shared.

Three things follow, and none is the 250,000. It is a second population: people under probation supervision, not people who applied for or received legal aid. It is a different part of government: HMPPS is an agency of the same Ministry, which is the controller for the incident, but its data is not legal aid data. And it is a different window: 2010 to 2017, eight years (derived), of which two, 2016 and 2017, hold more than 99% of the data, so at most 1% sits across the other six years (derived). The 99% is a share of the data in question, not of people, and the update does not say how the data is counted.

What the update does not give: a count of people ("a relatively small number"), a count of records, whether those people have been told, why probation data was in systems the legal aid attack reached, or how it relates to the legal aid systems. It says the picture changed because the agency's capability to identify data improved, which explains the timing and not the presence. Which part of the Data Protection Act 2018 governs probation service data, and so which breach clock and notification rules applied to it, is not established by anything read, and the Ministry's data protection officer is the person who can answer it.

Stated and not stated: the record, line by line

"Not stated" means not found in the sources listed at the foot of this briefing, read in full. It does not mean the information does not exist, and it can change within hours.

What the agency, the Ministry of Justice, Parliament and the regulator state about the incident, and what they do not, as read on 15 October 2026.

The question	Stated	Not stated
How many people?	Affected people are "only a fraction" of those who dealt with the agency (written statement, 14 October 2026). A count was forecast in "another five to six weeks" (23 October 2025), "later this month" (19 June 2026) and "later this year" (30 July 2026).	Any number or fraction, as at 14 October 2026.
How many records?	Approximately 250,000 before 2007. A "vast majority" between January 2007 and 16 May 2025.	The total, the count per year, the count before 1990 ("fractionally small"), and what a record is: a document, a transaction or a case.
What is the 1978 record?	"The earliest record currently verified dates from 1978."	Its group, its system, its contents, and whether earlier records exist. The word "verified" leaves open that older ones are not yet verified.
What is in the old records?	Fifteen groups of applicants and recipients, three of them with windows starting before 2007. Details "may include" names, dates of birth, case references and, for some groups, other items.	Which categories sit in the 250,000, and which groups hold them.
When did it happen?	First known entry 31 December 2024. Data exfiltrated from January 2025. Aware 23 April 2025. Wider scope found 16 May 2025. Public notice 19 May 2025.	When access ended, whether the old records were taken on one day or over months, and the date of the last exfiltration.
Were people told?	A public notice on 19 May 2025 and a helpline. "We did not write to all clients" because old addresses could cause "another data breach". The Ministry "will, where data allows" identify individuals.	How many people have been told directly, any date for direct notice, and the risk assessment behind the choice of a public notice.
Why were old records online?	Legacy technology "does not have automatic cleaning mechanisms", and records are kept until debts or statutory charges are discharged (23 October 2025).	A retention schedule, who decided to keep 1978-era records, and which records were due for deletion.
Same system?	48 systems and 120 components. Data "spread across a number of legacy systems".	Which systems held the pre-2007 records, and how they were reachable.
What has the regulator done?	The Ministry reported a breach in April 2025 (the regulator's log entry). On 18 June 2025 the regulator wrote that its "enquiries into the incident are in progress". The Ministry provided an update and "continue to cooperate fully".	Any finding, reprimand, notice or penalty. None found as at 15 October 2026.
What was the cause?	Criminals "were able to exploit vulnerabilities in the LAA's IT systems". Legacy systems were "not compliant with HM Government's Cyber Security Standards at the time of the attack".	The method ("in the interests of security"), which weaknesses, and why detection took 113 days (derived).
Who was behind it?	A "criminal group" and "sophisticated organised crime". The National Crime Agency and police are involved. An injunction bars publication.	A name, an attribution or a motive. The ministry had not verified the attackers' own claim reported in 2025.
What did it cost?	A forecast £22 million of operational and digital cost for 2025 to 2026. £10.5 million of stabilisation spend in 2024 to 2025. More than £200 million allocated for transformation, recovery and legacy migration. Pre-action letters received.	A final cost, the cost of notifying people, any compensation, and the outcome of any claim.

The count of people is the line that has moved least and been forecast most. The 23 October 2025 estimate has passed by 314 days if read at the end of its six weeks (derived). The 19 June 2026 "later this month" has passed by 106 days (derived). The 30 July 2026 letter extended the timetable and said a successor would write "later this year" with a "more definitive assessment". The 14 October update arrived without one. Each estimate was given with reasons, and the reasons are credible; the pattern is still a run of dated forecasts that the work could not meet.

Friendly names: what each label does and does not say

A comforting or neutral label is not a control, and not a measurement. Seven appear in this story.

Labels in the agency's, the Ministry's and the press's wording, where each appears and what the record leaves out.

The label	Where it appears	What it leaves out
"Legacy"	Ministerial statement, spokesperson, committee evidence, annual report.	The government's own plan defines legacy systems as "obsolete systems that can no longer be effectively supported or protected from attacks". The word places the fault in the machine and not in the decision to keep 47 years of data (derived) on it.
"Records"	The 250,000.	Not people, not documents. The agency says its data appears as transactions in many systems, with no whole file for a person.
"Affected" and "may include"	The update's tables and notes.	A group's window of dates, not a person's exposure. The agency says no table row means a person had "all, or any" of the listed items taken.
"Predate 2007" and "historical"	The update.	Old does not mean harmless. The update says the presence of old records does not mean everyone from before 2007 was affected, and does not say that no one was.
"Vast majority", "small proportion", "fractionally small"	The update and the written statement.	Three phrases and one number, with no denominator. The update and the statement word the same tranche differently.
"Stabilising" and "stabilise"	The Ministry's statement to the press.	The agency's annual report says the 2024 to 2025 stabilisation funding "did not substantially reduce the residual risk". The Public Accounts Committee called over £50 million of investment "insufficient".
"No indication" of publication	The update and the statement.	Not "no evidence" and not "has not been". The June 2026 answer says law enforcement monitors for it, including the dark web.

Two of these deserve a figure. The Ministry's spokesperson told BleepingComputer that it had "already committed £20 million" to stabilising and upgrading the systems before the attack and is "now investing more than £200 million". The ratio is 10 to 1, and £20 million is 10 per cent of £200 million (both derived); the increase is £180 million, or 900 per cent (derived). The primary record words these differently. The £200 million is "allocated" in the written statement, and in a June 2026 answer it is additional funding over "the spending review period" for "transformation, recovery from the cyber-attack, and for moving our legacy systems". It is not a security budget, and the sources do not say how much has been spent. The £20 million appears in ministerial answers as extra funding "this year", meaning 2025 to 2026, and the annual report gives £10.5 million for 2024 to 2025. Whether the £20 million was committed before 23 April 2025 rests on the spokesperson's word. The forecast cost of the incident itself, £22 million for 2025 to 2026, is 11 per cent of the £200 million (derived).

On the same record, the agency told Parliament in June 2026 that its legacy systems were "not compliant with HM Government's Cyber Security Standards at the time of the attack", that its digital infrastructure had been assessed in 2022 to 2023 as "the most complex and fragile across MoJ", and, in December 2025, that before the attack there was "no digital disaster recovery plan in place". Ministerial answers attribute the fragility of the systems to earlier underinvestment, a political claim this briefing does not judge; the Public Accounts Committee records only that the weaknesses had been known to the Ministry and the agency since 2021. The National Audit Office's overview of the Ministry's 2024 to 2025 accounts says the agency has received pre-action letters about possible damages claims, and its study of the Ministry's management of IT risk and cyber resilience is scheduled for spring 2027.

Why old records were still there: what has been said, and what has not

The question was put to the agency on 23 October 2025, about records going back to 2007: why was that data still on the system, and was there no cleaning? The answer was that "it is an age-old problem in relation to our legacy technology, which does not have automatic cleaning mechanisms", and that in legal aid records are often kept until debts or other matters are discharged, in some cases until a property is sold, because the agency can hold a statutory charge over it. The agency added that these were known risks and that it needed "modern, secure-by-default technology".

That is a stated reason for keeping some records. It is not a retention schedule, and it was given for 2007, not 1978. Nothing read says who decided that records from the late 1970s and 1980s should remain online, whether any record had passed its retention period, or whether records were archived and then restored into live systems. The agency's own annual report lists data protection governance and compliance among its headline corporate risks for 2024 to 2025 and says the complexity of its estate made reducing risk "challenging"; it says nothing on how long personal data is kept, and the update says nothing on deletion. The annual report does describe statutory charges, which are recovered when an asset is sold, and that fits the reason given for some civil records. The Government Cyber Action Plan of January 2026, searched for the same point, has nothing on retention or data minimisation either. The gap between a reason and a schedule is the finding.

Another public body was in a similar position this week: this site's briefing on the Housing Ombudsman case-system incident found no count, supplier or date stated. The difference here is that the agency has published a great deal, and the one number readers need is still missing.

The UK: what the law and policy say, and where each stops

The regulator changed its name during this story. On 30 September 2026 the Information Commission took over from the ICO, with no change to its powers. The three documents the Ministry issued on 13 and 14 October use both names. The statutory text on legislation.gov.uk now says "the Commission". The table uses the rules as read on 15 October 2026.

UK law and policy relevant to the incident, with where each stops. Quotations are short and exact; sources are linked in the list at the foot.

Rule or policy	What it says	Where it stops
UK GDPR Article 5(1)(e), storage limitation, and the [ICO's guide](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)	Personal data identifying people must be kept for "no longer than is necessary". The guide says organisations need a retention policy with standard periods, must review data and "erase or anonymise it when you no longer need it".	Sets no fixed period. It allows longer retention that can be justified, and the agency has given reasons of that kind for some records. No schedule is published. The guide is marked under review after the Data (Use and Access) Act.
UK GDPR [Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33) and the [ICO's breach guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/): the 72 hours	A controller must notify the regulator "not later than 72 hours after having become aware" of a notifiable breach, with reasons if later. Information can be given in phases.	The clock starts at awareness, not at the intrusion. The first known entry was 113 days before awareness (derived). The regulator's log says the report was made in April 2025 and withholds the date, so whether 72 hours was met is not on the record.
UK GDPR [Article 34](https://www.legislation.gov.uk/eur/2016/679/article/34): telling people	Where a breach is likely to cause a high risk, the controller must tell people "without undue delay". Where that would take disproportionate effort, "a public communication" must be "equally effective".	The agency chose a public notice because old addresses could cause a second breach. It does not cite Article 34 in any source read, and its risk assessment is not published. More than 17 months after awareness (derived), it has not published who was affected.
ICO [public sector approach](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/public-sector-approach/) (policy of 11 November 2025)	Warnings, reprimands and enforcement notices, with fines "only issued in the most egregious cases", judged on harm, negligence and previous infringements.	A discretion over fines, not an exemption. The regulator's response of 18 June 2025 says its enquiries are in progress. No outcome has been published. This site's briefing on [the ICO's notice on a police force's data handling](https://www.pk-sharma.com/briefing/ico-met-police-auror-500-accounts-179-people-no-dpia-governance-failure-dated-to-may-2018) shows the regulator at work on a public body.
[Government Cyber Action Plan](https://www.gov.uk/government/publications/government-cyber-action-plan), 6 January 2026, which replaced the [2022 to 2030 strategy](https://www.gov.uk/government/publications/government-cyber-security-strategy-2022-to-2030); GovAssure	"Our legacy systems often cannot be defended by modern cyber security measures." It estimates "nearly a third (28%)" of the government estate is legacy technology, makes accounting officers personally accountable for cyber risk, and the minister's statement cites this incident.	Policy, not statute. A search of its text found nothing on retention or data minimisation. It was published about eight months after the attack (derived). The Plan says government will be held to requirements equivalent to those in the Bill below.
[Cyber Governance Code of Practice](https://www.gov.uk/government/publications/cyber-governance-code-of-practice), April 2025	Sets out how company boards and directors govern cyber risk, mapped to the NCSC's Cyber Assessment Framework.	Voluntary, and written for company boards. It is not written for a government agency; the Action Plan covers those.
Cyber Security and Resilience (Network and Information Systems) Bill, [stages page](https://bills.parliament.uk/bills/4035/stages)	Lords report stage is listed for 26 October 2026 (provisional). The Action Plan says government will be held to equivalent requirements.	Not law today, and the breach came before it. The Action Plan describes it as covering essential and digital services. The Bill's text was not read for this briefing.
NCSC guidance: [asset management](https://www.ncsc.gov.uk/guidance/asset-management), [obsolete products](https://www.ncsc.gov.uk/collection/device-security-guidance/managing-deployed-devices/obsolete-products), the [22 June 2026 Five Eyes statement](https://www.ncsc.gov.uk/news/the-ai-shift-in-cyber-risk-why-leaders-must-act-now)	"All software and hardware eventually becomes out of date." "The only fully effective way to mitigate this risk is to stop using the obsolete product." "Unsupported systems are easy targets."	Guidance, not a duty. It is about the age of software and hardware, not of the data. No NCSC page read sets a limit on how old held data may be.

Taken together, the rules cover three different ages: the age of the system (the NCSC and the Action Plan), the age of the data (storage limitation, with no number), and the age of the incident (the 72 hours, from awareness). No rule links them. A body can follow the guidance on obsolete systems and still hold 1978 data on a modern one, and can hold 1978 data on a legacy one while its plan describes legacy replacement as a technology programme. The agency's own programme, set out in its annual report, is to remove dependency on its civil case system within three years; the description does not mention what is deleted along the way.

What to do, in the order worth doing

Three lists, one for the data protection officer of a public body, one for a legal aid provider or law firm that sent data to the agency, and one for a person who thinks they may be affected. Each uses only official channels and none needs a personal detail.

What could not be verified

• Any count of people, or total of records. None is stated. The 2.1 million "pieces of data" claim is the attackers' own, as reported by LBC in May 2025, and is unverified.
• The ICO's side. The regulator's FOI response and public pages were read. No investigation outcome, reprimand or notice was found as at 15 October 2026. The date of the breach report is withheld.
• The 1978 record. Which group, system or document it is, and whether the group in the table with a 1978 window holds it, is an inference.
• Two December 2025 end dates in the update's table are stated, not explained, and may be typographical. No question was put to the agency for this briefing.
• Written answers and committee evidence. The parliamentary web pages sit behind a bot check, which was not bypassed. The statements, answers, letters and transcript were read through Parliament's own published data service, and the links go to the human pages.
• Not read. The Treasury Minute response to the Public Accounts Committee's report, and the Justice Committee's findings of 17 July 2026. The agency's 2025 to 2026 annual report, which the 2024 to 2025 report says will formally record the incident, was not found on GOV.UK.
• BleepingComputer's account was read in full. Its "April 2025" breach date and "from 2010 onward" recap are not the agency's present record, as explained above.
• The spokesperson's claim that £20 million was committed before the attack rests on that statement alone.
• Time-stamped. Sources were read between 09:15 and 11:54 BST on 15 October 2026. A page's wording, the regulator's position or a count could change within hours.

The question that exposes the gap

What is the oldest personal record on the busiest system you run, who last decided it should still be there, and could you count the people in it by Friday?

Key facts