The Ince Group plc v Person(s) Unknown

The Claimant, an international commercial law and business services firm, applied without notice for an interim injunction to prevent the defendant from disclosing information stolen in a ransomware attack.

1. Whether it was appropriate to proceed without notice
2. Whether to hear the application in private
3. Whether to grant an interim injunction to restrain use and disclosure of the stolen information
4. Whether to grant a mandatory interim injunction requiring the Defendant to deliver up/ delete / destroy the stolen information and to provide a witness statement that it has complied with the mandatory injunction

1. It was appropriate to proceed without notice because the Defendant had demonstrated that it knew or should have known that its actions were of a criminal nature. The Claimant was being blackmailed and there was a real risk that notice would trigger the Defendant to disseminate the confidential information: [4]
2. It was also necessary to hear the matter in private to allow the court to control what information came out and not to hamper the efforts being made to trace Defendant and/or encourage others to search for the information: [3]
3. The Claimant was entitled to a prohibitory injunction applying the American Cyanamid principles, and if it was engaged, s12(3), Human Rights Act 1998. The elements of a breach of confidence claim were met and there was no sensible basis to argue that there could be any defence. Damages would not be adequate: [10]
4. The Claimant was also entitled to a mandatory injunction. The Court had a high degree of assurance that the Claimant would establish at trial the relief sought: [11]

This short judgment helpfully brings together in one place a number of points relevant to ransonware cases against a threat actor established in earlier decisions, including Clarkson v Persons Unknown (14 December 2017 & 6 March 2018), PML v Persons Unknown [2018] EWHC 838 (QB), 4 New Square v Persons Unknown (28 June 2021 & 14 September 2021) and Verlingue v Persons Unknown (18 March 2022)