The Legal Aid Agency (LAA) breach has grown from a 15-year exposure into something far older. An October 2026 update on GOV.UK says about 250,000 stolen records predate 2007, mostly from the 1990s and 2000s, and the earliest verified record dates from 1978. When the attack was disclosed in May 2025, applicants were told the exposure reached back to 2010, according to Civil Service World. The central lesson is not that government needs a new law. It is that data kept without a clear reason becomes a liability, and that the state should be held to the retention standard it already imposes on everyone else.
What the update says
The LAA first identified the attack on its online digital services on 23 April 2025. On 16 May 2025 it found that the attack was more extensive and that a significant amount of personal data had been exfiltrated, per the GOV.UK update. That update now says the bulk of the data covers civil claims from January 2000 and criminal legal aid claims from January 2007 to May 2025, with some categories reaching further back. One example is Very High Cost Case payments from 1981 to 2004.
The update also confirms that probation data was in the stolen material. It covers offenders managed between 2010 and 2017, with more than 99% relating to 2016 and 2017. The government describes the number of affected probation service users as "a relatively small number" and gives no figure.
According to The Record, Justice Minister Sarah Sackman called the incident "significant and complex" in a written statement to Parliament. She said criminals "were able to exploit vulnerabilities in the LAA's IT systems." Depending on the case, the data can include National Insurance numbers, dates of birth, financial assessments, bank and property details, and some partially redacted payment card details. The Record also reports that the hackers claimed in May 2025 to hold about 2.1 million pieces of data. That figure is the attackers' claim, not an official count. Sackman told the Commons there is no indication the data has been published, though a ministry spokesperson had said in May 2025 that publication was "when, not if."
The strongest case for the status quo
There is a serious argument for long retention in this area. Legal aid files can matter decades later. They support appeals, miscarriage-of-justice reviews, cost audits and disputes over payments. Deleting records too early could harm the very people the system exists to protect. Public bodies also operate under archiving and audit duties that private firms do not. A blanket rule of "delete after seven years" would be crude and could do real damage.
That argument justifies keeping some records. It does not justify keeping them in internet-reachable, operational systems. The question is where old data lives and who can reach it, not only whether it exists.
Retention is a security control
The UK GDPR already sets the standard. The ICO's storage limitation guidance says: "You must not keep personal data for longer than you need it." It adds that organisations should not keep data "just in case" and should "periodically review the data you hold, and erase or anonymise it when you no longer need it." Organisations must also be able to justify their retention periods.
On the published facts, a 1978 record sitting in systems that a criminal group could reach is hard to square with that standard. We do not know the full picture. Some of this data may have been lawfully retained for archival or legal purposes, and the investigation is ongoing. But the pattern in the update is the one regulators warn about. Material accumulates, gets migrated from one system to the next, and ends up in a repository nobody has reviewed. The update itself describes much of the data as "unstructured, fragmented, or incomplete," according to The Record. That is a sign of data nobody was actively managing.
The security logic is simple. An attacker can only steal what exists. Every record that was archived to offline storage, anonymised or deleted on schedule is a record that could not be extorted. Retention limits cost little compared with perimeter defences, and they shrink the damage from every breach, including the ones prevention fails to stop.
What proportionate regulation looks like
The temptation after a breach like this is to reach for new mandates: fixed statutory deletion periods, higher penalties for public bodies, or sweeping new reporting duties. We would resist most of that. Fixed periods applied across very different record types would be blunt. Bigger fines on departments mostly move money between parts of the same budget and do little for the people whose data was taken.
Three narrower steps fit the evidence better.
- Publish retention schedules. Departments should publish, per system, what they hold, why, and for how long. The ICO already expects documented periods. Transparency would make compliance checkable by Parliament and the public.
- Separate archive from operations. Records kept for legal reasons should move to restricted, offline or heavily isolated stores. They should not sit alongside live application services.
- Fund legacy retirement. The government says it is "retiring or isolating higher-risk technology" and pursuing longer-term work to modernise legacy systems. The GOV.UK update gives no timeline or budget. Parliament should ask for both.
The ICO's role matters too. The government says it has made the regulator aware and will keep engaging with it. The regulator's public handling of this case, including whether it treats the retention question as part of its inquiry, will show whether storage limitation is enforced against the public sector as firmly as against private companies.
The cost of getting this wrong
The people exposed are among the most vulnerable in the justice system. They include defendants, domestic abuse survivors, and people under probation supervision. Charities warned in 2025 that the data could include sensitive information about women and girls who survived abuse, per The Record. For these individuals, a leaked National Insurance number or case history cannot be reissued like a password.
A pro-innovation stance does not mean trusting institutions to hold data forever. It means expecting the public sector to practise the data minimisation it demands of industry. The LAA case shows what happens when it does not. The remedy is existing law applied with discipline, plus the money to retire systems that should have gone years ago.