Synnovis Services LLP v Person(s) Unknown

Hearing date: 12 th July 2024

Approved Judgment

This judgment was handed down remotely at 10.30am on 15 th August 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

The claimant seeks an in private hearing for its application for an urgent, without notice, interim injunction against the defendant or defendants whose identities are not known who are responsible for engaging in a cyber attack on the claimant's IT systems. The claimant is part of a pathology partnership with SYNLAB and part of its business is to provide laboratory services to two London based hospital trusts – Guy's and St Thomas' NHS Foundations Trust (“Guy's”) and King's College Hospitals Foundation Trust (“King's”).

On 3 June 2024 a cyber attack on the claimant's IT systems took place and the defendant(s) left a ransom note on the system. The claimant released a public update the next day on 4 June 2024 explaining that it had been the victim of a ransomware cyberattack affecting all its systems resulting in interruptions to many of its pathology services. and a further update on 17 June 2024 informing of the continuing problems and delays in providing its services and the work being undertaken to restoring services as quickly as possible.

On 19 June the ransomware gang, Qilin, spoke to the BBC and took responsibility for the attack and the BBC published an article stating that Qilin are a well known ransomware gang who have carried out criminal hacks for extortion purposes of a range of public and private services and companies since 2022. Some data from the cyber-attack was published via Telegram on 20 June 2024. Telegram is a could-based messaging service. On 21 June 2024 the MailOnline published an article stating that the ransomware attackers had obtained confidential information of medical conditions and blood test results of more than 100,000 patients. Much of the information and data obtained by the defendant(s) is confidential as it is commercially sensitive, private and is the confidential medical records of patients served Guy's and King's (“the information”).

The claimant released further public updates about the cyber attack on 21 and 24 June 2023 again seeking to reassure the public as best as possible. The BBC published a further article on 24 June 2024 about the cyber attack with similar information to that contained in the MailOnline article. On 27 June 2024 there was a post of information and statement published on a website called “Wikileaksv2”.

The Claimant emailed Telegram requesting the Telegram Information be taken down on 2 July at 11.55am. No response has been received. On 10 July 2024 the clamant notified Telegram that it would seek an urgent injunction in the Royal Courts of Justice on 12 July 2024, asking if it intended to make any representations or if it required any further information. Once again no response has been received.

The claimant also emailed Wikileaksv2 at abuse@nicenic.net asking for the information published on a website bearing that name be taken down from their platform. After initially receiving an auto-response in acknowledgement there was a substantive reply on 6 July 2024 stating that the domain name was not available in their system. The claimant believes that Wikileaksv2 is suspicious as a clone site and may be an offshoot of the defendant(s) organisation and did not inform them of their intention to seek this injunction.

The defendant(s) identity is not known, but they have invited communication to an email address. The defendant(s) do not have permission or lawful authority to obtain the claimant's data and information on its servers. The claimant has drafted and issued a claim form setting out its cause of action as breach of confidence. It has undertaken to serve it by 19 July 2024. It seeks three remedies: a non-disclosure order, an unmasking order and an order for delivery up and destruction of the information and material obtained in breach of confidence.

Today's application is for an order pursuant to CPR 25.1(1)(a) granting an interim injunction preventing the release or publication of data stolen from the claimant during the ransomware cyber incident which occurred on or around 3 June 2024 and prohibiting further attempted cyber attacks and orders for derogation from open justice.

I have read the skeleton argument, bundle served in support including the confidential witness statement of UGX and the bundle of authorities, most particularly, Armstrong Watson v Persons Unknown [2023] EWHC 762 KB.

I am satisfied that the claimant has addressed points that might have been raised by the defendants had they been present and represented.

Dealing with the matters in turn.

Holding this hearing in private requires a derogation form the open justice principle see CPR 39.2(3)(a), (c), (e) and (g) and s. 11 Contempt of Court Act 1981.

I am satisfied that exceptional circumstances apply and it is strictly necessary for the hearing to be held in private to secure the proper administration of justice. A private hearing is no more than is strictly necessary. The reason is obvious: this application relates to the theft of confidential, highly personal medical information, some of which has already been disclosed in a limited way and there is an ever present threat of further or more widespread disclosure. It is an ongoing and fast moving incident. Without a private hearing it will not be possible to ventilate the issues and discuss the evidence to enable a just decision to be reached: see Armstrong @ [19], the same reasoning applies here. The claimant does not seek anonymity, merely for this hearing to be held in private.

Next, the without notice application. The default position is that any party to proceedings is entitled to be on notice and able to appear and be represented at any hearing in which his interests may be affected. However an interim remedy may be granted without notice if there are good reasons for not giving notice ( CPR 25.3(1)). In this case the procedural requirements have been satisfied. S.12 Human Rights Act 1998 (“ HRA 1998”) is engaged since the relief sought may affect the exercise of the ECHR right to freedom of expressions. By s.12(2)(b) the court must be satisfied that...