The Legal Aid Agency said in an update published on 14 October 2026 that roughly 250,000 records stolen in the 2025 cyber-attack predate 2007, with the earliest verified record dating from 1978. Most of those older records are from the 1990s and 2000s, and only a very small number date from before 1990.

The agency said most affected data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or to cases live in that period. It also said probation data held by HM Prison and Probation Service was among the exfiltrated material, and that none of the data relates to victims of crime.

The LAA said it has no indication that the stolen data has been published or shared. It cautioned that the presence of pre-2007 records does not mean everyone who applied for or received legal aid before 2007 was affected, and that the information affected varies between individuals. The agency said it continues to work with the National Crime Agency, the National Cyber Security Centre and the Information Commission.