XXX v Persons Unknown

I like to think there is a hackers’ rehabilitation meeting called Anonymous Anonymous; I don’t know if I will ever find out whether it exists but that name, Anonymous Anonymous, would also serve as a good descriptor for the case XXX v Persons Unknown [2022] EWHC 2776 (KB).

In that case, a company with a substantial and sensitive international business fell victim to a ransomware attack. The hackers left a note to say that they had downloaded and encrypted the claimant’s databases and servers, this meant that the claimant was unable to access its files…unless it paid a $6.8 million ransom.

The claimant responded swiftly to issue an application for a without notice interim injunction which was granted and prevented the (anonymous) defendants from using or distributing the (anonymous) claimant’s confidential information. Interim injunctions are designed to protect the status quo before the case reaches trial, in which case if the claimant is successful a final injunction will be granted.

Whilst the interim injunction was granted, the defendants took no part in the claim as for them to do so, they would need to disclose their identities. As the defendants did not engage and service a defence to the claim, the claimant was able to apply for summary judgment on its claim. A summary judgment is the court’s determination of a claim or issue without a full trial.

The case of XXX v Persons Unknown is a rather interesting one as the claimant managed to obtain a final injunction against the defendants but at the same time retained its anonymity. The court found that as a result of the sensitive information held by the claimant (parts of which were protected by the Official Secrets Act 1989) that if its name was required to be disclosed, “third parties with malign intent may locate the stolen information on the so-called ‘Dark Web’”. The court went further and found that in this event, the court would then be the instrument which would cause the harm to the claimant that the defendants were seeking.

The court therefore proceeded to grant the final injunction against the defendants aka Persons Unknown and also provided the claimant with an anonymity order; welcome to Anonymous Anonymous.

The case shows the value of injunctions in relation to ransomware attacks and additionally that in certain circumstances, the court is also willing to grant these on behalf of anonymous claimants so as to not do them further harm.

Written by Sam O’Toole – Associate