Most teams treat the first victim bulletin as the inventory. You notify the people named in the ticket, freeze the tables your SIEM already knows how to query, brief the board, and declare the cybersecurity incident contained. Britain’s Legal Aid Agency just showed you how that habit fails. A forensic review widened the stolen set from a modern claims window into applications, payments, and files that reach back to 1978. The attackers didn’t need a second intrusion for that jump. You stored the extra decades for them.

The First Count Exists to Calm the Room

When a justice agency says a hack affected legal aid applicants, the public hears a bounded event. Bounded events soothe ministers. They also train your incident response muscle to stop asking questions once the first schema has a name.

SecurityWeek’s write-up of the forensic follow-up is specific about the working set. Most of the data covers applications, claims, and payments submitted between 2007 and 2025. That is already eighteen years of means-tested poverty, family disputes, criminal defense, and payment trails. The Record’s parallel reporting is the detail that should rearrange your retention meeting. Stolen records date back to 1978. Older. Broader than the government previously disclosed.

Sit with 1978 for a second. That is not a hot cache. That is a museum that still answered queries. Someone kept case history, identity attributes, or payment descendants reachable from the same estate that processes current claims. A firewall doing honest work at the edge never sees that decision. Packet filters don’t know you invited fifty years of clients into the blast radius.

This is a bad look for any public body that talks about data minimization. Private-sector copies of the same pattern are sitting in your warehouses. Keep the extract because Finance might ask. Skip the legal-hold calendar. Assume last year’s access review still maps the shares. Then act surprised when forensics finds a reporting replica the SOC never tagged as in-scope.

Your first count is a communications artifact. It reflects what you could prove on day two with the logs you already collect. Forensics is a different sport. It asks which systems could see the loot, which backups were mounted, which BI clones sat in the same subnet, and which “archive” was just a colder production table. If your playbook treats the initial number as a ceiling, you will under-notify, under-rotate, and under-scope on a schedule.

You already know the noisy failure mode. A brute-force spray against a forgotten VPN lights up dashboards. A SELECT over a forty-year claims archive looks like reporting. Threat detection tuned for malware beacons will miss the query and the business reason you still had the rows. Cyber security programs that measure success by tickets closed before the forensic report lands are measuring comfort.

Reputation Is a Terrible Threat-Protection Control

The same first-number instinct shows up in how you rank bugs and how you treat “known good” hosts. You collect a score. You collect a platform name. You call that risk management.

Dark Reading’s argument this week is one you should steal without buying a product. Vendor-assigned vulnerability scores describe a theoretical universe. Real exploitability depends on whether the weak service can reach your data, whether you have compensating controls, and whether anyone is using the bug against shops that look like yours. A critical on an isolated lab box is homework. A medium on the host that mounts your customer archive is a crisis. Rank exposure. Rank reachability. Leave the brochure math in the spreadsheet’s last column.

Help TDS makes the reputation version of this failure obvious. Researchers tied a long-running traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka, a rebrand of an older monetization shop known as ROI777. Partners get PHP templates. Those templates land in compromised websites and shove visitors toward tech-support scams. More than 20,000 Cloudflare Pages domains hosted that junk.

Your users have been trained to trust the padlock and the big-name edge network. Plenty of threat-protection stacks do the same, scoring Pages projects as cleaner than a random VPS. Affiliates counted on that. A firewall busy dropping obvious brute-force noise will not save the clerk who opens a Pages URL that looks like a legitimate Cloudflare project. Mass-produced static hosts are untrusted until you can prove they are yours.

Seven Critical Chrome Bugs Still Need an Owner

Chrome’s latest drop is the boring, necessary version of the same lecture. Google fixed 37 security flaws, seven of them critical. Some of those bugs can run code through a crafted webpage. Auto-update is a control you still have to verify. Unmanaged kiosks, contractor browsers, and “temporary” jump boxes still need a name next to them. If those browsers can reach case files, finance, or admin SSO, the advisory’s severity column is the least interesting field you have.

Cybersecurity Scope Starts With What You Kept

If you want fewer 1978 surprises, treat retention as security hardening with a delete key. Defense in depth that never includes “this row should not exist” is theater. You can start this week, with controls that do not care which vendor sold you a dashboard.

1. Name the oldest live record in every system that holds customer, citizen, patient, or employee data. Skip the retention policy PDF. Query production, replicas, search indexes, data lakes, and “reporting” copies for MIN(created_at) or the equivalent. If nobody can answer, that absence is the finding, and it belongs on the incident bridge the next time someone says “we think it was only current claims.”
2. Rebuild any open incident’s data map from reachability, not from the first table the SOC named. Include backups that were mounted, object stores the app role could list, admin workstations with cached exports, and BI extracts. Write the notification list from that map, then rotate every credential and token that could read it.
3. Run a browser and workstation census against the current Chrome advisory. Isolate stragglers that can still touch sensitive apps. Unmanaged endpoints that can open your archive are in-scope for this week, even if the ticket says “client patching.”
4. Treat newly registered or mass-produced Pages, Workers, and lookalike static hosts as untrusted in mail and web filters until you have an allowlist for properties your company actually owns. Teach help desks that a familiar CDN brand is not an all-clear.
5. On a 90-day loop, delete or vault-offline everything past its legal hold. Make deletion an auditable control with owners, not a hope in a privacy notice. Pair that with quarterly access reviews that start from “who can SELECT the oldest cohort,” because that cohort is your real ransom note.
6. Keep a living exposure register instead of a CVSS sort. For each internet-facing service and each sensitive datastore, record reachability, data age, exploit evidence in the wild, and compensating controls. Promote tickets by blast radius. Demote theoretical criticals that cannot see a record you would be ashamed to lose.

Do the immediate four while the Legal Aid headlines are still in the room. The last two are how you stop the next forensic review from humiliating you in public. None of this requires a new platform. It requires you to stop confusing a first measurement with a complete one.

Frequently Asked Questions

Why do forensic reviews keep expanding breach scope?

Day-two counts reflect the logs and tables you already knew how to query. Forensics follows credentials, replicas, backups, and archives the application could reach. If those copies still hold decades of files, the stolen set grows without a second break-in.

Should we ignore CVSS and just patch everything?

Keep the score as one input. Promote work by whether the weak service can touch long-lived personal data, whether exploit code is circulating, and whether you have a real compensating control. A medium on an archive host outranks a critical on an isolated lab box.

How do we handle scam sites on well-known cloud front ends?

Stop treating platform reputation as a pass. Allowlist the Pages and similar hosts you own, filter or warn on the rest in mail and browsing, and train help desks that a familiar edge brand is still a destination you have to verify. Affiliates will keep parking scams wherever users already feel safe.

Sources

• UK Legal Aid Agency Hack Scope Widens After Forensic Review
• UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978
• Vulnerability Management Isn’t About the Score; It’s About How It Applies to You
• Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
• Update Chrome: Google fixes 37 security flaws, including seven critical bugs