Factual and Procedural Background
The Plaintiff, part of a pathology partnership with Company A, providing laboratory services to two London-based hospital trusts, suffered a ransomware cyber attack on 3 June 2024. The Defendant(s), whose identities remain unknown, left a ransom note on the Plaintiff's IT systems. The Plaintiff publicly acknowledged the attack and its impact on pathology services with updates on 4 June and 17 June 2024. On 19 June 2024, a ransomware gang known as Qilin claimed responsibility, and some stolen confidential data, including sensitive medical records of patients served by the hospital trusts, was published on Telegram on 20 June 2024 and subsequently reported in the media. Further disclosures appeared on a website called "Wikileaksv2".
The Plaintiff sought removal of the published data from Telegram and Wikileaksv2 without success. The Plaintiff issued a claim form alleging breach of confidence and sought remedies including a non-disclosure order, an unmasking order, and an order for delivery up and destruction of the stolen information. The current application is for an urgent, without notice, interim injunction to prevent further disclosure and cyber attacks, and for the hearing to be held in private due to the sensitive nature of the information involved.
Legal Issues Presented
- Whether an urgent, without notice, interim injunction should be granted to prevent the Defendant(s) from publishing or further disclosing confidential information obtained through a cyber attack.
- Whether the hearing should be held in private, derogating from the open justice principle, due to the sensitive and confidential nature of the information.
- Whether the Plaintiff can serve the Defendant(s) by alternative means given the unknown identity and location of the Defendant(s).
- Whether an anti-hacking injunction preventing further unauthorized access to the Plaintiff's IT systems should be granted.
- Whether the Defendant(s) should be ordered to identify themselves and provide details for service.
Arguments of the Parties
The opinion does not contain a detailed account of the parties' legal arguments.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Armstrong Watson v Persons Unknown [2023] EWHC 762 KB |
Principles regarding injunctions against unknown defendants and private hearings in cyber attack and confidentiality cases. |
Used to justify holding the hearing in private, the necessity of injunctions, and unmasking of anonymous defendants. |
| American Cyanamid v Ethicon [1975] AC 396 |
Test for granting interim injunctions based on likelihood of success at trial. |
Applied to assess whether the Plaintiff was likely to establish at trial that publication should be restrained. |
| Cream Holdings v Banerjee [2005] 1 AC 253 |
Flexibility in the test for interim injunctions affecting freedom of expression; allowing short-term injunctions where serious damage may occur. |
Supported granting an interim injunction to prevent serious damage pending full trial. |
| PML v Persons Unknown [2018] EWHC 838 (QB) |
Requirement for anonymous defendants to identify themselves in breach of confidence cases. |
Supported the order requiring the Defendant(s) to disclose their identities. |
| LJY v Person(s) Unknown [2017] EHC 3230 (QB) |
Confidentiality and public interest considerations in breach of confidence cases. |
Supported the conclusion that the information remained confidential and that damages would be inadequate. |
| Re J (a child) [2013] EWHC 2694 (Fam) |
Jurisdictional principles for service out of jurisdiction and court’s reach over defendants. |
Supported jurisdictional basis for service and enforcement of injunctions beyond jurisdiction. |
| In re Liddell's Settlement Trusts [1936] Ch 365 |
Jurisdictional principles for service out of jurisdiction and enforcement of court orders. |
Supported jurisdictional basis and enforcement of injunctions against defendants outside the jurisdiction. |
Court's Reasoning and Analysis
The court held that exceptional circumstances justified holding the hearing in private to protect the confidentiality of highly sensitive medical information and to prevent further disclosures. The court found compelling reasons to proceed without notice to the Defendant(s) due to the risk of further unauthorized disclosures and the criminal nature of the acts involved. The Plaintiff had provided appropriate undertakings including payment of damages and full disclosure obligations.
Applying the American Cyanamid principles and Human Rights Act 1998 considerations, the court concluded that the Plaintiff was likely to succeed at trial in establishing that publication of the information should be restrained, given the unlawful acquisition of the data and the ongoing extortion. The court accepted that the Defendant(s) must be ordered to identify themselves, as anonymity was being used to facilitate unlawful activity.
The court granted an anti-hacking injunction to prevent further unauthorized access to the Plaintiff’s IT systems, relying on its broad discretionary powers under the Senior Courts Act 1981. The court also found that alternative service by email to the Defendant(s) was appropriate and that jurisdictional requirements for service out of the jurisdiction were met. The court acknowledged the Plaintiff’s ongoing efforts to locate the Defendant(s) and the impracticality of other service methods.
The court further allowed for NHS England or other data controllers to apply to join the proceedings on short notice for enforcement or variation of the order. The return date for the interim injunction was set for 30 July 2024.
Holding and Implications
The court GRANTED the Plaintiff's urgent, without notice, interim injunction application. The order includes:
- An injunction restraining the Defendant(s) from using, publishing, disclosing, or communicating the confidential information obtained in the cyber attack.
- An order requiring delivery up, deletion, or destruction of the confidential information held by the Defendant(s), with a witness statement confirming compliance.
- An order requiring the Defendant(s) to identify themselves and provide contact details for service.
- An anti-hacking injunction preventing further unauthorized access to the Plaintiff’s IT systems.
- Permission for alternative service of court documents via the email address provided by the Defendant(s).
- Provision for NHS England or other data controllers to join the proceedings on short notice.
The direct effect is to protect the Plaintiff’s confidential information and IT systems pending a full trial, and to compel the Defendant(s) to identify themselves. No new legal precedent was established; rather, the decision applies existing principles to the urgent circumstances of a ransomware cyber attack involving sensitive medical data.