XXX v. Persons Unknown
[2022] EWHC 2776 (KB)
In the High Court of Justice, King’s Bench Division
Case Number QB-2022-001083
Before Justice Cavanagh
Decided on October 25, 2022

Relevancy of the Case: Claim to remove the claimant’s name from the judgment in a ransomware attack due to sensitivity of information involved

Statutes and Provisions Involved

• The Civil Procedure Rules 1998 (Section 39.2(3)(a), 39.2(3)(g))

Relevant Facts of the Case

• The claimant has applied for summary judgment in relation to ransomware attack. The claimant had obtained an interim injunction without notice, restraining the defendant from distributing the claimant’s confidential information.
• The defendants did not attend the case proceedings even after being aware of them. They did not comply to the return date of injunction and did not attend the hearings.
• The claimant wants to recognise and identify the defendant before it claims for damages.

Prominent Arguments by the Counsels

• The claimant’s counsel stated that the claimant is a multi-discipline company providing technology-led solutions for security sensitive and highly classified projects of national significance. The claimant’s clients require the utmost discretion, secrecy, and protection from external threats.
• The counsel further argued that there would be a significant rish if its name becomes public. The claimant’s client data is of interest to several categories of persons with potentially malicious intent, including hostile nation states, organised criminal groups, and terrorist organisations.

Opinion of the Bench

• Merely because the claimant has suffered a ransomware attack is not a sufficient reason to keep the claimant’s name a secret.
• However, the circumstances justify anonymity due to the nature of the work and the risk of disclosure carried by the claimant.
• If the claimant is identified, it would advance the defendant’s objective to harm the claimant.
• The information provided to support the application of anonymity indicates the high level of sensitivity of the stolen information.
• The anonymity order aligns with the Article 6 of the European Convention on Human Rights. Making the hearing of summary judgment held in private would be an unnecessary restriction.
• The defendant obtained the information to blackmail the claimant. The defendant did not have the authorisation to take the information.

Final Decision

• The court granted an injunction and approved the terms of the draft order on anonymity.

Aditi Mangesh Sawant, an undergraduate student at NMIMS Kirit P Mehta School of Law, Mumbai, Ritesh Karale, an undergraduate student at Maharashtra National Law University, Mumbai, and  Yagyanseni Acharya, an undergraduate student at VIT School of Law, Chennai, prepared this case summary during their internship with The Cyber Blog India in January/February 2024.