Legal Aid Agency gov.uk Legal Aid Agency data breach: what happened and what to do
The Legal Aid Agency found a cyber attack on its online services on 23 April 2025 and said on 19 May 2025 that applicant data was taken, including contact details, dates of birth, national ID numbers, criminal history and financial records. It hasn't said how many people are affected.
View all 13,177 breaches- Breach date
- 23 Apr 2025
- Made public
- 19 May 2025
- Data exposed
- Names, Dates of birth, Government issued IDs, Criminal history, Employment status, Financial records
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The Legal Aid Agency (LAA) became aware of a cyber attack on its online digital services on 23 April 2025. On 16 May it found the breach was wider than first thought, and the Ministry of Justice published a notice on GOV.UK on 19 May. The LAA is working with the National Crime Agency and the National Cyber Security Centre.
The first notice said data went back to 2010. A later update widened that, and the October 2026 data update lists dates by category of legal aid, some going back well before 2010. Whether your record is in scope depends on the type of legal aid you applied for and when, so read that list.
Sources checked: gov.uk, actionfraud.police.uk
Last verified against the official page:
What was exposed
The LAA says applicant data that may have been taken includes contact details, dates of birth, national ID numbers, criminal history, employment status and financial records such as contributions, debts and payments. Provider data was affected too. The agency has not said how many people are affected. It says it has no indication the data has been released, and an injunction prohibits sharing it.
Legal aid files are sensitive. Details like these let a scammer pose convincingly as a solicitor, court or government body, and a date of birth plus a national ID number is what's used in identity fraud.
What the LAA says to do
The government's guidance is to watch for unexpected messages and calls, verify the identity of anyone who contacts you before sharing information, use strong passwords you don't reuse, and report suspected scam calls to Action Fraud. Questions go to the LAA Customer Services Team on 0300 200 20 20, 9am to 5pm, Monday to Friday.
What to do if you were in it
- 1
Read the LAA's list of affected data
Check the October 2026 update against the type of legal aid you applied for and when. Call 0300 200 20 20 with questions.
- 2
Be wary of unexpected contact
If someone calls or messages about legal aid, a case or your finances, don't share details. Check who they are by contacting the organisation on a number you find yourself.
- 3
Report scams
Report suspected scam calls and messages to Action Fraud.
- 4
Update your passwords
If you reuse a password from any legal aid account elsewhere, change it everywhere and use a different strong password for each account.
- 5
Check other breaches
Run a free Serus scan to see whether your email or phone appears in this and other breaches.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by the Legal Aid Agency breach?
The LAA hasn't said how many people are affected. Its latest update lists the categories and dates of data involved, so check it against your own applications.
What was exposed?
Contact details, dates of birth, national ID numbers, criminal history, employment status and financial records may have been taken.
Has the data been published?
The LAA says it has no indication it has been released, and an injunction is in place to prohibit sharing it.
Who do I contact?
The LAA Customer Services Team on 0300 200 20 20, 9am to 5pm, Monday to Friday.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
