Photo by Maksym Kaharlytskyi on Unsplash
Most businesses never think about data they collected years ago. It sits in a shared drive, in a backup somewhere, or in a folder nobody has opened since a previous member of staff set it up. The Legal Aid Agency breach changed that conversation. When attackers accessed LAA systems, they did not just find recent records. They found personal information dating back to 1978. Nearly fifty years of case data, belonging to people who had sought legal help, often during the hardest moments of their lives, had been sitting there. And then it was taken.
What the Legal Aid Agency Breach Actually Involved
The Legal Aid Agency funds legal cases across England and Wales. The cyber incident, which became public in 2025, confirmed that attackers had accessed a significant volume of personal data. Names, addresses, dates of birth, national insurance numbers, financial details. What set this story apart from the usual breach news was the timeframe. Some of the data went back to 1978. That is not a systems quirk or a rounding error. It reflects a pattern that organisations of every size share: data that was collected for a legitimate reason, retained well beyond any reasonable justification, and never audited or reduced.
This is not a government-specific failure. It is a data retention failure. And most small businesses in the UK are running the same risk.
Why Small Businesses Should Read This as a Warning, Not Just a News Story
If your business has been running for more than a few years, you are almost certainly holding data you have forgotten about. Employee records from staff who left a decade ago. Client files from projects that finished well before GDPR came into force. Supplier contacts from a system you stopped using. Old payroll data in a spreadsheet that never got deleted. These are not hypothetical examples. They are exactly what comes up when a business actually audits what it is holding, often for the first time.
The LAA had a specific reason to retain historical legal case records. Most small businesses do not have an equivalent justification for keeping personal data indefinitely. Yet many do, simply because nobody ever made a deliberate decision to delete it.
GDPR Has a Principle That Most Businesses Have Not Applied to Their Old Data
Data minimisation is one of the core principles in UK GDPR. It means you should only hold personal data you actually need, for as long as you actually need it. In practice, that principle is often applied carefully to new data collection and quietly ignored for everything that was already sitting in the system before anyone started paying attention to compliance.
The uncomfortable reality is that a breach does not distinguish between your newest customer record and one from fifteen years ago. If it is on your systems, it is at risk. And if the Information Commissioner's Office comes asking questions after an incident, saying you forgot you had the data is not a defence.
Old Data Is Not Worthless to an Attacker
There is a common assumption that old records are not worth stealing. That assumption is wrong. A name, a date of birth, a national insurance number, and a home address from 1999 can still be used to open fraudulent accounts, pass identity verification checks, or build convincing phishing messages targeted at the individual involved. People do not change their date of birth. National insurance numbers do not expire. Addresses from a decade ago can confirm identity when combined with other data an attacker already holds.
We have written previously about what happens when identity documents are exposed in a breach, and the same logic applies here. The age of the record does not reduce the damage it can cause when it ends up in the wrong hands.
What You Should Actually Do About the Data You Are Holding
The answer is not to panic. It is to make a decision, probably for the first time, about what your business genuinely needs to keep and for how long.
- Audit what you have. Before you can manage old data, you need to know it exists. Check your shared drives, email archives, old backups, and any legacy systems that were never formally decommissioned. You may find records you had no idea were still there.
- Set a retention schedule. Different types of data have different legal requirements. Payroll records, employment contracts, and financial documents each have their own statutory retention periods. Everything else should have a defined lifespan and a clear deletion point. If you do not have a written retention policy, this is the right time to create one.
- Delete what you do not need. Once a retention period has passed, deleting data is not a risk. Keeping it is. This applies to backups as much as live systems. A backup that has been running for five years with no retention limit is essentially a permanent archive of everything your business has ever touched.
- Restrict access to what you must keep. If records genuinely need to be retained for legal or regulatory reasons, the number of people who can access them should reflect that. Old HR files from staff who left years ago do not need to sit in the same location as current payroll. Applying proper access controls to archived data means that even if someone does get into your systems, the damage is contained rather than total.
- Check whether archived data has any access controls at all. Many businesses move data to archive storage and then leave the permissions unchanged. If the same accounts that access live systems can also reach a folder of records from ten years ago, those records are as exposed as anything else on your network.
How This Connects to Your Overall Security Picture
Protecting the systems your team uses every day is important. But it is not the full picture if years of forgotten data are sitting on the same infrastructure, unrestricted and unknown even to you. A managed security approach includes visibility into what your systems actually hold and how that data is controlled, not just monitoring activity at the edge.
We covered the broader question of what happens when employee records are caught up in a high-profile breach in an earlier post. The principle there applies here too. The data on your systems is your responsibility, regardless of how old it is or when you last thought about it.
A Practical Takeaway
Pick one action this week. Check whether your backup storage has any retention limit set. Look through your shared drive for folders containing data from more than five years ago. Or write down the categories of personal data your business holds and ask whether you still need each one. Any of those steps is more useful than reading this and moving on. The LAA breach is a reminder that data you stopped thinking about does not stop being a liability.