Facts

The Ince Group Plc, an international commercial law and business services firm, applied to the court without notice for an interim non-disclosure order against the Defendant, an unknown party, following a cyber-attack in March 2022 in which the Defendant had obtained certain confidential data belonging to Ince. The Defendant threatened to publish the stolen data on the “dark web” if Ince did not pay a substantial ransom demanded of it.

Decision

Part of the hearing was heard in open court and part in private as a public hearing would have defeated the interests that Ince was seeking to protect. The case concerned an ongoing incident of apparent blackmail and Ince’s submissions and evidence covered more than the contents of the information stolen. They included what was known to date and the steps taken to deal with the incident. In Mr Justice Saini’s view, there was a need not to hamper the efforts to trace the Defendant and/or encourage others to search for the information.

Saini J was also satisfied that it was appropriate not to give the Defendant notice. On the material before him, it was clear that the Defendant had demonstrated that it had information it knew it should not have and knew or suspected that its actions were of a criminal nature. It was clear that the Defendant was motivated by money and had threatened to damage Ince by a form of blackmail. There was a real risk that notice would trigger the Defendant to disseminate the information in question, which Saini J was satisfied had the necessary quality of confidence.

Saini J considered that the Defendant did not have any basis for arguing that there was any just cause or excuse for publishing any information, so it was difficult to see how Article 10 (freedom of expression) European Convention on Human Rights was engaged. However, in any event, Saini J was satisfied on the information before him that Ince was likely to establish at trial that publication of the information in question should not be allowed.

As for the interim relief sought, Saini J said that the Defendant had come into the possession of Ince’s confidential information through what seemed to be clear criminal and unlawful actions. The Defendant was not seeking to publicise the information for any legitimate reason, but merely sought to obtain a commercial benefit by effectively holding Ince to ransom.

Accordingly, it was clear that Ince should be entitled to a prohibitory injunction. The basic elements of a classic breach of confidence claim had been established. Ince had title to sue, there was clearly a duty of confidence owed by the Defendant, and the underlying material was clearly confidential. It was also clear that there were threats of disclosure. There was no basis to argue that there could be any public interest of the publication of the material, and it was clear that damages would not be adequate.

Ince also sought relief of a mandatory nature requiring the Defendant to deliver up and/or delete and/or destroy the information it had stolen. Following Nottingham Building Society v Eurodynamics Systems [1993] FSR, which considered the principles to be applied when considering a mandatory injunction, Saini J found that Ince had established that a mandatory injunction was necessary. Ince provided the court with a high degree of assurance that it would be able to establish at trial the relief that it sought on a mandatory basis at this stage, and there was no basis for the Defendant to be able to resist relief requiring delivery up and/or deletion and/or destruction. Saini J was therefore satisfied that a mandatory injunction should also be granted.

Saini J noted that under CPR 25A PD 5.1(2) an applicant on an application without notice must undertake to serve on the respondent the application notice, evidence in support and any order made. However, Ince sought an order that it did not have to serve the confidential witness statement on the Defendant unless and until the Defendant identified itself and provided an address for service.

Given that the Defendant was seeking to blackmail and harm Ince, Saini J agreed that to send the evidence relied upon to the Defendant might lead to its misuse; and to particularise the confidential information stolen could provide the Defendant with valuable information as to which documents or categories of documents were considered particularly sensitive. Accordingly, he granted the modifications to the model order sought by Ince.

Saini J also agreed with Ince that it was entitled to a modification to the wording to provide that any relevant third parties must have possession of or access to the information and therefore an existing interest in it before being provided with documents on the court file for the private hearing, even with a written undertaking.

As for the confidential schedule and the description of the confidential information itself, Saini J was satisfied that the information was sufficiently described.

As for the form of service on the Defendant, Saini J was satisfied that he should authorise alternative service to allow Ince to serve the Defendant via the website through which it had been communicating with the Defendant. (The Ince Group Plc v Person(s) Unknown [2022] EWHC 808 (QB) (1 April 2022) — to read the judgment in full, click here).