A cyber incident does not end when the first public statement is issued. Organisations also need a way to revise decisions and communications as the evidence develops.

On 14 October, the Legal Aid Agency published a further update about the cyber-attack identified in April 2025. It said detailed digital analysis had refined its understanding of the date range and types of information exfiltrated. Approximately 250,000 records predated 2007, and some probation data was also identified in the material taken.

The Agency said the attack affected complex digital systems and significant volumes of information, much of it unstructured, fragmented or incomplete. That made analysis complex. It also stressed that falling within a listed group or date range does not, by itself, mean an individual's information was exfiltrated. At the time of the update, it had no indication that the stolen data had been published or shared.

AV Resilience interpretation

For regulated organisations and critical-service providers, the practical lesson is about managing uncertainty, not assuming this incident predicts their own exposure. An initial assessment needs clear ownership, an evidence trail and a route for changing decisions when new facts emerge.

Test these questions in your next incident exercise:

- Who owns the record of what is confirmed, what is provisional and what is still unknown?

- Can teams trace a revised data assessment to the services, suppliers and people potentially affected?

- Who decides whether new evidence changes notifications, customer communications or recovery priorities?

- Can the response team update its message consistently without presenting an earlier assumption as a confirmed fact?

What AV Resilience can do

AV Resilience Consulting can help review incident leadership, decision rights and communications arrangements, then exercise a scenario in which the assessed scope changes during the response. The work can connect business impact analysis and dependency mapping with the decisions leaders need to make under pressure, producing a prioritised improvement plan rather than another untested document.

Primary source

Legal Aid Agency: cyber security incident data update, 14 October 2026