HCRG Care Limited v Persons Unknown

In a cyber-attack involving stolen confidential data, ransom demands and threats of disclosure, the court continued an interim non-disclosure injunction. Blackmail and criminal threats did not engage an alleged defendant’s justifiable Article 10 rights. The court applied the American Cyanamid principles: a serious issue to be tried, damages inadequate, a cross-undertaking, and a balance of convenience favouring protection against potential damage. A return-date application may be decided on the papers where the defendant has not engaged, no other party has communicated with the court, and there has been no material change. Private hearings and other departures from open justice require strict necessity and should be reviewed on the return date.

HCRG Care Limited, a national health and care organisation, claimed breach of confidence after persons unknown using the name Medusa obtained confidential data during a ransomware attack and threatened wider disclosure. Soole J granted an interim injunction without notice on 28 February 2025. At the return date, the claimant sought continuation of the injunction, validation of service by email, retrospective amendment of the alternative-service provisions, and determination on the papers. The central issues were service, open justice and Article 10, the applicable interim-injunction test, and whether the injunction should continue.

1. Determination on the papers. The court was satisfied that the defendant had not engaged, no other party had communicated with the court, and there had been no material change since the earlier order. It was therefore appropriate to determine the return-date application on the papers, consistently with Armstrong Watson LLP v Persons Unknown (No 2) and University and College Union v Persons Unknown (no2).
2. Open justice and Article 10. Departures from open justice are justified only in exceptional circumstances and must be strictly necessary. The court accepted the approach in Armstrong Watson LLP v Persons Unknown and the leading authority of JIH v News Group Newspapers. The claimant had taken all practicable steps to notify the respondent, satisfying s. 12(2) of the Human Rights Act 1998. Section 12(3) was not engaged. In circumstances involving criminality, blackmail and threats to reveal sensitive private information, the defendants were not exercising a justifiable freedom of expression right.
3. Merits. Applying American Cyanamid v Ethicon, there was clearly a serious issue to be tried. Damages would not be an adequate remedy because of the sensitivity of the data. A cross-undertaking had been given, and the balance of convenience plainly favoured continuation of the injunction to contain potential damage.
4. Service. Email service, including a link to documents on a filesharing site, appeared to have effectively notified the defendant. Validation of service and retrospective amendment of the alternative-service provisions were reasonable in light of apparent attempts to obstruct service.
5. Order. The interim injunction was continued as requested.

On 28 February 2025, Soole J granted an interim injunction without notice. This judgment determined the return-date application and continued that injunction.