Armstrong Watson LLP v Person(s) Unknown
Reference:  EWHC 762 (KB);  4 WLR 41
Court: King's Bench Division, Media and Communications List
Judge: Ritchie J
Date of judgment: 31 Mar 2023
Summary: Interim injunction - Ransomware attack - data breach - blackmail - breach of confidence - private hearing
Adam Speker KC - Leading Counsel (Claimant)
Instructing Solicitors: DAC Beachcroft LLP for the Claimant
The Claimant, a limited liability partnership of accountants and tax and business advisers, applied without notice for an interim injunction to prevent the defendant from disclosing information stolen in a ransomware attack.
- Whether it was appropriate to proceed without notice;
- Whether to hear the application in private;
- Whether to grant interim injunctions to restrain use and disclosure of the stolen information and requiring the Defendant to deliver up/ delete / destroy the stolen information and to provide a witness statement that it has complied with the mandatory injunction;
- How service should be carried out;
- Whether service out of the jurisdiction should be permitted;
- The documents to be provided to the Persons Unknown and others.
- It was appropriate to proceed without notice because the Defendant had demonstrated that it knew or should have known that its actions were of a criminal nature. The Claimant was being blackmailed and there was a real risk that notice would trigger the Defendant to disseminate the confidential information: -;
- It was also necessary to hear the matter in private to allow the court to control what information came out and not to hamper the efforts being made to trace Defendant and/or encourage others to search for the information: -;
- The Claimant was entitled to a prohibitory injunction applying the American Cyanamid principles, and if it was engaged which the judge did not consider it to be, s12(3), Human Rights Act 1998: -. The elements of a breach of confidence claim were met and there was no sensible basis to argue that there could be any defence. Damages would not be adequate. The Claimant was also entitled to a mandatory injunction. The Court had a high degree of assurance that the Claimant would establish at trial the relief sought: -;
- Service could be carried out via the Defendant’s website or by the original email used: ;
- It was proper to order service out. Loss and damage would be caused here: ;
- It was proper to restrict access to documents to the Defendant unless and until they identified themselves and provided an address for service. It was also proper to restrict access to documents to certain third parties: -.