decrypted · 16 october 2026 · ransomware and cybercrime · vulnerabilities and patching · uk policy and law

The Legal Aid Agency breach reaches back to 1978

The Legal Aid Agency breach is back, and this time the surprise is its age. In an update published this week, the agency and the Ministry of Justice said about 250,000 stolen records predate 2007, and the earliest verified record dates from 1978. The attack began in April 2025.

What the update says

Most of the data relates to applications, claims or payments between January 2007 and 16 May 2025, or to cases live in that period. Depending on the case, it can include names, dates of birth, National Insurance numbers, postcodes, bank and property details from financial assessments, and partially redacted payment card details. The agency stresses that a pre-2007 record does not mean everyone who used legal aid before then is affected.

The extortionists claimed more than two million people. The government has not confirmed that figure, so treat it as an unverified claim. Ministers say there is no indication the data has been published, and a court injunction already forbids sharing it.

Why the scope keeps growing

Think of a warehouse where nobody has counted the stock in twenty years. After burglars empty a shelf, you learn what was there from the labels they left behind. The agency has described the data as unstructured, fragmented or incomplete, which explains why each update has moved the start date: 2010, then 2007, now 1978.

The route in was not exotic. The ministry says criminals exploited vulnerabilities in the agency's systems, reached stored personal information and copied it out. Public reporting does not say which vulnerabilities, so I will not guess. The lesson sits behind the door: decades of old data were reachable from systems that attackers could get into.

The Secure by Design lesson

Three unglamorous design decisions would have shrunk this incident.

Retention by default. Data that has done its job is deleted or archived offline, with a named owner and a date. A 1978 record in a live system is a liability with no business purpose.
Segmentation. A portal for applying for legal aid should not share a blast radius with decades of case history.
An inventory you can read. If you cannot say what you hold, you cannot tell victims what was taken.

The ministry says it has strengthened authentication and access controls, improved monitoring and begun retiring or isolating higher-risk legacy systems. Welcome, but note the order: it came after the theft. The department also says it had committed £20 million to upgrading the agency's digital systems before the attack and is now investing more than £200 million.

What UK directors should ask

What is the oldest record we hold, and why? Which system would an intruder reach first, and what sits behind it? If we were breached tomorrow, how long would it take to say exactly who was affected?

The people here include defendants, their partners and, as charities warned in 2025, possibly domestic abuse survivors, so the harm is not abstract. Government policy is not to pay extortion, and rightly so. That policy works best when the stolen data is worth less to criminals than it might be. Deletion is the cheapest way to make that true. Opinion, not advice: a retention schedule is a security control.

Also this week

Palo Alto PAN-OS zero-day. Palo Alto Networks published CVE-2026-0322 on 14 October: an authenticated code injection in the PAN-OS management interface that gives root, scored 8.6 on CVSS 4.0. The vendor says very limited exploitation has been observed, lists no workaround, and says risk is highest when the management interface is reachable from the internet. Restrict it to trusted internal addresses or a jump box, then apply the fix for your branch. Fixed versions differ by release train, so read the advisory table rather than assuming one version number. The advisory also lists three attacker IP addresses worth searching for in logs. Reporting does not yet say who is behind the attacks or when exploitation began. An admin page on the open internet is a design choice, and an avoidable one.

Self-replicating AI, with caveats. Anthropic's Frontier Red Team published research on small open-weight models spreading across cheap Android TV boxes. The best performer reached all eight nodes in four of five trials. The targets had no authentication on their debugging ports, the authors call the results an upper bound, and spread is slow. The authors project that small models could reach this capability by the end of the year, on a rough trend fit they admit is only a proxy. That is a forecast, not an observation. The practical task for directors is unchanged: inventory connected kit, remove unauthenticated management access, and watch for odd device-to-device traffic.

Sources

If you want help working out what data you hold and how long you should keep it, get in touch.