If your address was confidential, ask the Legal Aid Agency (LAA) whether your records were involved, what information they contained, and what protective steps it recommends. The LAA says attackers accessed and downloaded data from people who used its digital legal-aid service between 2007 and 16 May 2025, and addresses may have been included.
The breach does not mean every applicant's address was accessed. The Legal Aid Agency says affected records may have contained addresses, contact details, dates of birth, national ID numbers, criminal history, employment and financial information, and sometimes partners' information. The Legal Aid Agency's breach notice explains the potentially affected data categories.
Table of Contents
- Was my confidential address included?
- What should I ask the Legal Aid Agency?
- Can I make a subject-access request?
- What warning signs should I watch for?
- What if my address must remain confidential?
- Frequently Asked Questions
Was my confidential address included?
Ask the LAA directly whether your individual records were among the accessed data. The published categories describe information that "may have" been included, so the general breach announcement does not establish that every applicant's address was exposed. Contact the LAA even if you applied many years ago.
The affected digital-service period covers applications made between 2007 and 16 May 2025. Prepare identifying details that can help the agency locate your records, but do not send sensitive information to an unexpected caller or message. Use contact details from the LAA's official guidance rather than details supplied by an unverified contact.
What should I ask the Legal Aid Agency?
Keep your questions specific and ask for a written response where practical: The LAA's published breach guidance directs incident questions to Customer Services on 0300 200 20 20. Its guidance also lists [email protected] for subject-access requests. The Ministry of Justice incident guidance provides those routes.
- Were my records included in the incident?
- Was my address or other confidential contact information present?
- Which categories of my information were accessed or downloaded?
- Could information about my partner or household have been included?
- What steps does the LAA recommend for someone facing a safety risk?
Can I make a subject-access request?
Yes. A subject-access request is a free request for the personal data an organisation holds about you. The Legal Aid Agency says you can ask the Ministry of Justice why it holds your data, who it may share it with, and for a readable copy.
The LAA's personal information charter describes this right. A subject-access request may help you understand what information the Ministry of Justice holds, but it is a separate step from asking whether your records were involved in this specific incident. State clearly that your request relates to the legal-aid data breach and ask the agency to address both points. If disclosing your current address could create a risk, explain that concern when contacting the agency and ask what safer communication method it can use.
What warning signs should I watch for?
Treat unexpected calls, texts, emails, or requests for documents as untrusted until you confirm the sender independently. Someone referring to your legal-aid application, personal history, finances, or address may sound convincing because those details could relate to the affected data categories. Do not use links or phone numbers supplied in a suspicious message.
Find the LAA's contact route through an official government page, then ask whether the communication is genuine. The LAA says it has no indication that the stolen data has been released and continues to monitor the situation. An injunction also prohibits unlawful use, disclosure, publication, or communication of information obtained from LAA systems; the government says violating it could lead to imprisonment. The current incident guidance sets out those protections.
What if my address must remain confidential?
Tell the LAA that disclosure of your address could create a personal-safety risk. Ask whether it can avoid repeating the address in correspondence, use a safer channel, or explain what information it needs before you provide anything.
Keep a record of your contact with the agency, including dates, reference numbers, names, and the questions asked. If you receive a threatening or clearly fraudulent message, preserve it and report it through the appropriate official channel. The most useful first question is direct: "Were my records involved, and did they contain my confidential address?".
Frequently Asked Questions
Does the breach prove that my address was exposed?
No. The LAA says addresses may have been included in affected records, but that does not establish that every applicant's address was accessed.
Is there a charge for asking what data the Ministry of Justice holds?
No. The LAA says a subject-access request is free.
Where should I start?
Ask the LAA whether your records were involved and independently verify any unexpected request for information.
You Might Also Like
- Legal Aid Agency Data Breach: Why the Affected Application Period Now Starts in 2007
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files
- Legal Aid Agency Data Breach: Why Criminal History and Financial Records Raise Different Risks