What the update says
The Legal Aid Agency (LAA), the public body administering legal aid in England and Wales, clarified on October 14, 2026 what was exposed in the cyberattack disclosed in 2025. It says some records from before 2007 are involved, with the oldest dating to 1978. That describes the age of some records, not everyone affected.
Records differ from person to person
The information associated with cases varies. The agency also mentions probation data from HMPPS relating to a relatively small number of people supervised between 2010 and 2017; more than 99% of that supervision data relates to 2016–2017. This does not mean every case contains the same information.
What cannot be concluded
The 1978 date does not mean a record from every year was stolen, or that every legal aid applicant is affected. The LAA says it has no indication that stolen data has been published or shared. Public information does not establish a complete number of affected people or the precise data held about each one.
Reduce phishing risk
A breach can make messages mentioning a legal case, an old file or a relative sound more convincing. Verify the sender independently, avoid unexpected links, and never provide a password or sign-in code in response to a message. If someone calls about a case, hang up and call a number listed on the official website.
Protect accounts that access case records
For organisations, the practical reminder is to limit accounts that can access archives, remove unused access, and require strong authentication on tools holding sensitive data. After a credible alert, revoke relevant sessions and rotate exposed secrets. Our guide to responding to a compromised password covers the first steps.
Soclyde’s role
Soclyde helps teams share and rotate passwords for work services. The vault cannot determine whether someone appears in the LAA data or replace official notification channels. It can help coordinate access rotation if a work account needs to be secured.
