Legal Aid Agency data breach

Were you involved in a legal aid application between 2007 and 2025?

You may be able to join a group legal claim if you applied for legal aid between January 2007 and 15 May 2025.

Hackers stole sensitive personal information from the Legal Aid Agency (LAA) in a major cyber attack in 2025. The government has confirmed that the stolen data includes information about people who applied for or received legal aid.

We are working with Bingham Long, a law firm investigating a group compensation claim, to help affected people explore whether they can claim compensation.

Check if you could join the group claim

You could be eligible to join Bingham Long’s Legal Aid Agency group action if:

You don’t need to have received confirmation that your information was stolen to register your interest. Bingham Long will assess your circumstances and whether you have a potential claim.

What happens when I register?

Registering your interest is the first step. It doesn’t mean you’ve automatically been accepted into the group claim or that you’re entitled to compensation.

Bingham Long will review your information and let you know what further details or evidence may be needed. You’ll also be able to receive updates about the claim as it develops.

How much does it cost to join?

Bingham Long is offering the claim on a no-win-no-fee basis. If your claim succeeds, the firm will take no more than 25% of any compensation awarded, including VAT.

Before agreeing to join, make sure you understand the terms of the agreement and any circumstances in which costs might apply.

Consumer Voice receives a fee for introductions to Bingham Long. This helps fund our free work supporting consumers and holding companies to account.

You can read more about how these arrangements work in our guide to no win, no fee arrangements and find out more about how Consumer Voice works with law firms.

What happened in the Legal Aid Agency cyber attack?

The Legal Aid Agency, part of the Ministry of Justice, became aware of a cyber attack affecting its online digital services on 23 April 2025.

On 16 May 2025, it confirmed that the attack was more extensive than first thought and that hackers had stolen a significant amount of personal information. These systems are used by legal aid providers to process applications and receive payments.

The breach was reported to the National Crime Agency and the National Cyber Security Centre, and the data protection regulator has been informed. A court injunction has been put in place prohibiting the sharing of stolen data. The government says it has no indication that the stolen information has been published or shared.

Latest update: stolen records date back to 1978

On 14 October 2026, the government confirmed that hackers had stolen around 250,000 records dating from before 2007, with the earliest verified record from 1978. Most of these older records date from the 1990s and 2000s.

What data has been exposed?

The Government has stated that the compromised data may include:

• Names, addresses and contact details
• Dates of birth and National Insurance numbers
• Employment and financial information
• Details of legal aid applications, including some legal and financial assessments
• Information about criminal cases, including charges, convictions or sentences in some circumstances
• Details of partners or family members named in applications

Some information about solicitors, legal aid providers and other people connected with cases was also stolen. This includes bank details held for some legal aid providers.

The type and amount of information taken varies between individuals. Not everyone who applied for legal aid will have been affected, and not everyone affected will have had all these details stolen.

How do I know if my data was affected?

The Legal Aid Agency is continuing to investigate exactly whose information was stolen. It has not confirmed a process for notifying everyone individually.

If you used legal aid during the affected period, it is sensible to take precautions. But being within that period doesn’t mean your information was definitely stolen.

If you are concerned that you may have been affected, you can register your interest in the group claim and ask Bingham Long to assess your position.

Can I get compensation for the Legal Aid Agency data breach?

You may be able to claim compensation if your personal information was affected and you suffered harm because of the breach. This can include financial loss, but it can also include distress or anxiety.

Compensation isn’t automatic. Whether you have a claim will depend on what happened to your data and the impact on you.

Bingham Long is investigating the circumstances of the cyber attack and its impact on affected individuals.

Who is Bingham Long? 

Bingham Long is a litigation law firm specialising in civil litigation and group action claims, including data protection cases.

The firm is regulated by the Solicitors Regulation Authority and is investigating the circumstances of the Legal Aid Agency cyber attack and its impact on affected individuals.

Protect yourself after a data breach

If you applied for legal aid during the affected period, it’s sensible to take precautions:

• Be alert for suspicious emails, texts or phone calls.
• Do not share personal information unless you have independently verified who you are speaking to.
• Change passwords, especially if you reuse them.
• Monitor bank accounts and credit reports for unusual activity.
• Be particularly cautious about anyone contacting you unexpectedly and claiming to be from the Legal Aid Agency or offering compensation.

You can read our guide to protecting yourself and claiming compensation after a data breach.

Think you’ve been affected? Register your interest in the Legal Aid Agency group claim and find out whether you could be eligible.