Synnovis Services LLP v Persons Unknown

The court may grant urgent interim relief against persons unknown responsible for a ransomware attack where confidential information has been unlawfully obtained and threatened with disclosure. A private hearing is justified where confidentiality and the proper administration of justice require it. A without-notice injunction may be granted where there are good and compelling reasons to fear further disclosure. The court applies the American Cyanamid principles, as modified by the statutory protection for freedom of expression, and may grant relief where publication should not be allowed, including short-term relief to hold the ring where necessary. Delivery-up, destruction, unmasking and anti-hacking orders may be granted where they are reasonable, proportionate, just and convenient. Alternative service by email and service out of the jurisdiction may be permitted where the relevant procedural gateways are satisfied.

The claimant, a pathology services partnership, sought urgent without-notice interim injunctions against unidentified persons responsible for a ransomware attack on its IT systems. The attackers obtained confidential commercial information and highly sensitive medical data, published some material and threatened further disclosure unless a ransom was paid.

The claimant sought non-disclosure, delivery-up, destruction, unmasking and anti-hacking orders. It also sought a private hearing, alternative service by email and permission to serve out of the jurisdiction. The central issues were whether the procedural and substantive requirements for those orders were satisfied.

1. Private hearing. The hearing was properly held in private under CPR 39.2(3) and section 11 of the Contempt of Court Act 1981. Exceptional circumstances existed because the application concerned stolen medical information, further disclosure remained an immediate possibility, and confidentiality was strictly necessary to enable the issues and evidence to be addressed justly.
2. Without-notice relief. CPR 25.3(1) and section 12 of the Human Rights Act 1998 were engaged. There were good and compelling reasons not to notify the defendants because notification created a real risk of further unauthorised disclosure. The claimant had complied with the procedural requirements and provided the necessary undertakings.
3. Interim injunction and disclosure-related orders. Applying American Cyanamid v Ethicon and section 12(3) of the Human Rights Act 1998, the claimant had established that publication should not be allowed. The information had been obtained through criminal and unlawful conduct for commercial gain, remained confidential and was not subject to a public-interest justification for disclosure. Delivery-up, deletion, destruction and unmasking orders were reasonable and proportionate. The defendants’ anonymity did not prevent relief where their conduct appeared unlawful and the organisation behind it had no legal identity.
4. Anti-hacking injunction. An order prohibiting further unauthorised access to the claimant’s IT systems was just and convenient under section 37(1) of the Senior Courts Act 1981.
5. Service and jurisdiction. Service by the email address supplied by the defendants was the only realistic method available and satisfied CPR 6.6, 6.15, 6.27, 6.37(5)(b)(i) and (ii), and 6.38. The breach-of-confidence gateway, reasonable-prospects test and England-and-Wales forum requirement for service out were met. The court could restrain acts within and, where appropriate, beyond the jurisdiction.
6. Disposition. The injunction and related orders were granted. NHS England and other relevant data controllers were permitted to apply to be joined. A return date was fixed for 30 July 2024.

First-instance decision. No prior appellate decision is stated in the judgment.