The Legal Aid Hack Reached a File From 1978. Nobody Had Deleted It.

01 2010, then 2007, then 1978

The agency has had to restate the size of this breach three times. In May 2025 it said the data belonged to people who had applied for legal aid online since 2010. In July 2025 it moved that back to 2007 [ GOV.UK, 2025 ] . On 14 October 2026, after finishing its analysis of what was exfiltrated, it said the material reaches back almost five decades [ GOV.UK, 14 Oct 2026 ] .

What sits in those records varies by person. The Record lists names, dates of birth, National Insurance numbers, postcodes, case dates and costs, financial assessments of defendants and their partners with bank and property details, and in some cases partially redacted card numbers [ The Record ] . Probation data was in there too: names, dates of birth, nationalities and case references for offenders supervised between 2010 and 2017, more than 99% of it from 2016 and 2017. Officials say none of it concerns victims of crime [ Civil Service World ] .

The hackers claimed data on more than 2 million people. That is their number, and officials stress that a count of records is not a count of people [ eSecurity Planet ] . The LAA says it has no indication the data has been published or shared. In May 2025 a spokesperson had called publication a question of “when, not if” [ The Record ] .

02 Four months inside before anyone looked

December to late April is about four months. For roughly three of them, data was leaving the building. The annual report puts it plainly: the investigation showed the systems were breached from December 2024, with data exfiltrated from January 2025, and the attack detected in April was reported to the ICO [ Law Gazette ] .

That is why the scope kept moving. When you spot an attacker on day 120, you are reconstructing four months of activity from whatever logs survived. You do not know which databases they opened. You do not know which archive they found. So the number goes up as the forensics come in: 2010, 2007, 1978. Every restatement is another round of letters, another call from the press, another question from the regulator.

You can shorten dwell time only if you can answer one question: when someone who should not be there starts moving through your network, does anything tell a person? That means logs you actually keep, alerts someone reads, and a test that proves both work. Most small firms have antivirus that would catch a noisy tool. Far fewer would notice a valid account copying a file share at 2am for a fortnight.

03 The data nobody deleted

A 1978 record cannot be stolen in 2025 unless someone kept it. UK GDPR already says you should not hold personal data longer than you need it, and that you should be able to justify the retention periods you set. The ICO calls this storage limitation, and recommends a retention policy, periodic review, and erasure or anonymisation once the data is no longer needed [ ICO ] .

Public bodies hold records for reasons a business does not, and we are not judging the LAA’s retention schedule here. The pattern is the useful part. Old data rarely sits in the shiny new system. It sits in the thing everyone forgot: a migration export, a legacy database kept “for reference”, a file share from before the last office move. Those places get the least patching and the least monitoring, and they hold the most history.

In a UK business, the 1978 file usually looks like one of these:

• The old CRM export. A CSV of every customer since the company started, saved to a shared drive during a migration in 2019.
• The application nobody switched off. A legacy accounts or booking system kept running “in case we need to look something up”, on a server that stopped getting updates years ago.
• Backups of decommissioned systems. Full copies of a database you retired, still mounted, still readable.
• Former clients at your MSP. If you are a managed service provider, the tenants, credentials and backups of customers who left in 2021.
• HR and payroll archives. Every leaver’s bank details and National Insurance number, kept far past any statutory period.

Each of those adds to your breach without adding anything to your business. Delete it and it cannot be stolen, cannot be ransomed and does not appear in your ICO report.

04 What to retire, what to test, what to report

The ICO clock starts when you become aware of a breach. Under UK GDPR Article 33 you report to the Information Commissioner without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk. You can report what you know and add detail later [ ICO ] . The LAA case shows why you need that second part. You will not know the full scope in 72 hours if the attacker had four months.

Three jobs shrink both the breach and the report. None of them needs a £200m programme.

Retire

• List every place personal data lives, including exports, archives and backups. If nobody can name the owner, that store is the first candidate to go.
• Set a retention period per data type and write down why. Then delete or anonymise anything past it.
• Switch off legacy applications you only keep for look-ups. Export the few records you must keep to locked, offline storage.

Test

• Run an internal test that starts from a single compromised laptop or account and measures how far it gets, and how long before anyone notices.
• Check that logs from file servers, cloud storage and admin accounts are kept long enough to reconstruct months, and that someone reads the alerts.
• Rehearse the first 72 hours: who calls whom, who decides whether to report, who drafts the ICO notification.

Report

• Keep a breach log even for incidents you decide not to report. The ICO expects you to record them.
• Agree in advance with your MSP or IT provider how fast they tell you about an incident. As controller, your 72 hours start when you know.

Cyber Essentials covers firewalls, secure configuration, user access, malware protection and patching. It is worth having, and it does not ask how long you keep data or whether you would notice someone inside. The NCSC’s guidance and an internal penetration test fill that gap. For another case where the alarm came far too late, read how Denmark found its register breach on an invoice.

The LAA’s 1978 record spent decades as nobody’s problem, until it became a headline. Somewhere on your network there is a file like it, and an account that could reach it without anyone noticing. We can find both in 14 days. Get a free audit and see your oldest data, and your blind spots, before someone else does.