Legal Aid Agency breach: revised scope

The Legal Aid Agency breach matters to practices that provide publicly funded legal advice and representation in England and Wales. The agency administers legal aid and holds information connected with applicants and providers. Its 14 October 2026 update adds detail about data taken in the 2025 attack. A practice that assessed the incident earlier should compare its recorded assumptions with that later evidence.

The immediate task is to revise what the practice knows, what it still needs to establish and what it can responsibly tell people. A category in an agency notice may make your records relevant to an assessment. It does not prove that every person in that category had their information taken. Equally, uncertainty about an individual record is not a reason to postpone the practice's assessment of its responsibilities.

This article is for people managing that evidence and decision process within a legal-aid practice. If you are seeking information about your own data, use the agency's official update and contact guidance. A general article cannot establish whether your particular record was affected.

Read the update as later evidence about the same attack

The agency identified the cyber attack on 23 April 2025. On 16 May it established that data had been taken and that the incident was more extensive than initially understood. The October 2026 publication provides a later account of the affected data. It is not evidence that a new attack occurred on the publication date.

The 14 October update describes approximately 250,000 records predating 2007. Those are records, not a count of distinct people. For a practice whose earlier assessment excluded older matters, the finding is a reason to revisit that exclusion. It does not establish which former client appears in the affected records, or prove that the age of a record itself makes its retention unlawful.

Provider information also deserves attention. The update's potential data categories include contracts and schedules, office details, payments and banking information, and contact details. It also covers portal-user and access information such as names and email addresses, correspondence in the CCMS and MAAT systems, and limited fee-earner names. CCMS and MAAT are agency systems referenced in the notice; the important question for a practice is whether its dealings with those systems make a category relevant to its review.

A provider review should therefore consider the firm's own records and relevant staff information alongside client matters. Keep the agency's qualifiers when describing a category. Do not turn a list of potentially affected information into a confirmed account of what happened to your firm.

The agency reports no indication that the data has been published or shared. Attribute that statement to the agency and the dated update. It is not a guarantee against future misuse, nor proof that a person faces no risk. An internal decision that relies on it should retain that limitation.

Preserve the earlier account before correcting it

Locate the practice's earlier incident record, the source it relied on and any approved communication. Record which statement the new information changes. Retain the original account with its date so a later reviewer can understand what the practice knew when it made the earlier decision.

For example, an earlier note might have excluded an old archive because it assumed the agency's affected records began later. The October update can invalidate that assumption without proving that any particular archived case was taken. The correction should identify both conclusions. Replacing "outside the scope we assessed" with "definitely exposed" would introduce a different unsupported assertion.

Ask the person responsible for the records to identify the information the practice can establish through authorised access. That may include whether it undertook relevant legal-aid work, which provider account it used, what categories it supplied and what dated correspondence it retains. An internal file can establish the practice's relationship with the agency. It cannot, on its own, establish which agency-held copy an attacker obtained.

Avoid moving confidential case files into a general incident spreadsheet merely to document that review. The decision record can refer to a restricted source and its owner without reproducing the underlying client details. Preserve necessary evidence through the practice's authorised process and keep access appropriate to the people doing the assessment.

A fictional practice corrects its communication decision

Consider a fictional practice whose privacy lead reviews the October update. Its earlier internal account had treated pre-2007 matters as outside the review. A partner now proposes telling every former legal-aid client that their information was definitely stolen.

All records, roles and decisions in this example are hypothetical. They illustrate how to revise an account; they are not findings about a real practice or an individual affected by this attack.

The records manager confirms that the practice handled legal-aid matters before 2007 and used an agency provider account. That makes the newly described categories relevant. The manager cannot establish whether a particular client's information was among the records taken. The privacy lead rejects the proposed statement because it converts possible relevance into certainty for everyone.

The same review rejects the practice's old blanket exclusion of earlier matters. Neither statement now represents the available evidence. The lead prepares an amended record for the responsible partner:

The partner accepts that correction and assigns the privacy lead to reassess the practice's own position. The records manager owns the internal category review. The practice's designated agency contact seeks clarification through the official channel about the unresolved scope questions. A request for clarification is an action, not proof that the answer has been obtained.

The practice prepares the following internal wording for approval:

The agency's 14 October update includes older records and provider-related information. Our previous exclusion of pre-2007 matters is no longer supported. We are assessing the categories relevant to this practice. We have not established individual exposure for every former client. Refer individual questions to the privacy lead rather than confirming or ruling out exposure from the date of a matter alone.

That wording corrects the known error and gives staff an escalation route. It is not a substitute for any notification the practice is required to make, or a reason to give affected people only a holding response when more is required. The privacy lead assesses those questions separately and obtains specialist advice where needed.

Assess duties while the remaining facts are investigated

The ICO's personal data breach guide explains the duties that can apply when an organisation is aware of a personal data breach. The practice must establish its role and the facts relevant to its own processing. The agency's public announcement does not automatically create an identical notification obligation for every provider.

Where a breach is notifiable to the ICO, the guide requires notification without undue delay and within 72 hours of awareness where feasible. If all the information is not available together, it permits information in phases without undue further delay. That approach does not require waiting until every record is certain before making a required report.

Where a personal data breach is likely to result in a high risk to individuals, the ICO guidance requires informing them without undue delay. This is a distinct threshold from reporting to the regulator. A decision about reporting to the regulator should not be copied into the individual-communication field without assessing that question. Likewise, a practice acting as a processor has different responsibilities from a controller, including notifying the relevant controller without undue delay. The privacy lead needs to resolve the practice's role for the processing in question rather than assume its relationship with the agency settles it.

The October news date does not restart an earlier reporting clock. New evidence may change an existing risk assessment or require further information to be supplied, but it should not erase when the organisation became aware or what it previously decided. Preserve those dates and reasons. The incident response planning guide covers the broader response process; this review concerns the effect of later scope evidence on an existing account.

Give unresolved questions a consequence and an owner

In the fictional practice, the partner approves the corrected internal account and an immediate reassessment of notification and communication responsibilities. The decision is not to wait for an agency reply before considering those duties. The privacy lead records the available evidence, the outstanding record-level uncertainty and the reasons for the next action.

The partner requires a progress review the following working day. That is the practice's fictional management checkpoint, not a regulatory deadline or permission to delay an action already due. If the agency has not replied, the lead reports the unanswered question and its effect on the assessment. They seek the appropriate specialist advice and progress any required action on the available information.

If new evidence identifies a particular affected group, the lead revisits the assessment for that group and the accuracy of previous statements. If staff have already repeated the unsupported blanket exclusion, the partner assesses who received it and what correction is appropriate. Quietly changing the internal file would not correct a misleading account someone else still relies on.

The completed outcome is a revised evidence record, a rejected claim of universal exposure, approved internal guidance and owned follow-up decisions. Individual exposure remains unresolved where the evidence does not establish it. A pending question can coexist with completed corrective work; it should never be relabelled "no impact" just to close the record.

Bring the evidence gap to a compliance review

Start with the earlier account, the dated agency update and the precise assumption that changed. Identify the person who owns each missing fact and the decision that depends on it. That gives a reviewer something more useful than an unstructured folder of incident correspondence.

My IT compliance consulting can help organise evidence, identify gaps, clarify responsibilities and review control readiness within an agreed scope. Request a free consultation about your revised evidence record if your practice needs help turning the new information into an owned review. Bring a summary of the gap rather than confidential client files. Specialist legal advice, decisions on legal notification duties and incident-response work require the appropriate separately agreed expertise.