Legal Aid Agency Data Breach: How to Ask What Was Taken

The ministry asks for “a description of where your personal data may be held”, including which part of the ministry you dealt with and any reference numbers and dates. For legal aid, that means:

• That it is about the Legal Aid Agency, and whether it was civil or criminal legal aid.
• Your case or certificate reference, the rough dates, and the solicitor’s firm, if you have them.
• The breach question. Ask whether any of your data was in the material taken in the cyber attack, and which. The wording on the data breach page works, with “the Legal Aid Agency cyber attack announced on 19 May 2025” as the incident.

Identification. The ministry asks for two pieces: one with a clear photo of you, such as a passport or driving licence, and one showing your name and current address, such as a utility or council tax bill or a bank statement. Any bill should be dated within the last six months.

Our free letter builder will draft the request if you are emailing or posting it.

The government says it found a cyber attack on the agency’s online services on 23 April 2025. It told legal aid providers that some of their financial details may have been exposed. On 16 May it discovered the attack was more extensive than first understood, took the online services down, and on 19 May announced that the group behind it had accessed a large amount of information about legal aid applicants.

In its October 2026 update the government says most of the data relates to applications, claims or payments between January 2007 and 16 May 2025, but “approximately 250,000 records predate 2007”, mostly from the 1990s and 2000s, with the earliest from 1978. Some probation data was taken in the same attack. Earlier statements gave 2010, then 2007, as the starting point; the October 2026 update is the latest.

The government says it has “no indication that the stolen data has been published or shared”, and an injunction prohibits anyone sharing it.

Not necessarily. The government is clear that “the fact that you received or applied for legal aid during one of the periods described above, or interacted with the Probation Service, does not, by itself, mean that your information was contained in the data exfiltrated by the attackers”.

What was taken varies by person. The October 2026 update has a table by type of legal aid and date range — from names, dates of birth and National Insurance numbers on costs claims, to offences, pleas and sentences for some Crown Court cases, to the full answers on some civil applications, including financial details of partners and family members. In the minister’s words, “in no case was a complete record relating to a legal aid case affected”.

The minister also told Parliament on 14 October 2026 that the ministry “will, where data allows, be able to identify whether any specific individual’s data was exfiltrated in the cyber-attack”. No published process yet says how to ask that. A subject access request that asks the question directly is the formal way, though only the copy of your data is a legal duty — see what a request does and does not get you.

The October 2026 update says the stolen material included some names, dates of birth, nationalities and case reference numbers of people managed by the Probation Service between 2010 and 2017, almost all from 2016 and 2017. Probation records have their own route in the ministry’s charter: the same online form, or email data.access1@justice.gov.uk.

For questions about the attack itself, the government gives the agency’s Customer Services Team on 0300 200 20 20, 9am to 5pm, Monday to Friday, or email corporatecorrespondenceteam@justice.gov.uk. That is for questions; a request for your data goes to the Disclosure Team above. The incident guidance page and FAQ have the rest.

Its advice is to stay alert to suspicious messages and calls, to be cautious about unexpected requests for personal or financial information, to check independently who you are talking to, and to use strong passwords you do not reuse. The general steps after a breach are also on the data breach page.

We found no government statement about compensation for people whose data was taken. For legal aid providers, ministers have said there will be no separate compensation scheme for this incident. The ministry reported the breach to the ICO, which has published no outcome.

We do not handle claims or refer anyone to those who do. What the law says about compensation generally is on the data breach page.

Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the ICO, the UK's data protection regulator.