HCRG Care Limited v Persons Unknown [2025] EWHC 794 (KB)

[2025] EWHC 794 (KB)Case No KB-2025-000736
IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA and COMMUNICATIONS LIST
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 02/04/2025
Before
DEPUTY HIGH COURT JUDGE SUSIE ALEGRE
Between
HCRG CARE LIMITEDClaimant
Adam Speker KC & Felicity McMahon (instructed by Pinsent Masons) for Claimant
Approved JudgmentThis judgment was handed down remotely at 10.30am on 2 April 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives..............................DEPUTY HIGH COURT JUDGE SUSIE ALEGRE

Susie Alegre :

[1]The Claimant is a national health and care organisation with approximately 4500 employees. It is commissioned by the NHS and local authorities in England and provides a broad range of healthcare and support services. The Defendant(s) are persons unknown that go by the name of “Medusa”.[2]On or about 26 January to 12 February 2025 the Defendant took data from the Claimant’s IT systems that was confidential to the Claimant and/or its employees, clients or associated third parties (“the Stolen data”). The Claimant was informed by the Defendant on 12 February 2025 that it had been the victim of a ransomware attack and that the Defendant had access to the stolen data. The Defendant has also disclosed some of the stolen data.[3]The claim is one of breach of confidence in relation to the stolen data. This judgment relates to the return date for an order for an interim injunction that was made on 28 February 2025 by Mr Justice Soole. His reasons for granting the injunction at a private hearing without notice were given in an ex tempore judgment which he gave in public of which I have seen an unapproved note.[4]I have also received a bundle for this application including, among other papers, the application notice for the return date, updated witness statement of Patrick Birchall, CEO of the Claimant, dated 27 March 2025, particulars of claim and a draft order. I have also received the Claimant’s skeleton arguments for the hearing of 28th February 2025 and for this hearing. Consideration on the Papers[5]The Claimant asked me to consider the application on the papers or in private. I have considered the Practice Guidance on Non-Disclosure Orders [2012] 1 W.L.R. 1003, at paras. 9 to 15 which covers exceptions to the principle of open justice and the analysis of Ritchie J in Armstrong Watson LLP v Persons Unknown [2023] EWHC 762 (KB):
“17. The general rule is that hearings are carried out, and judgments and orders are made, in public. This applies to applications for interim non-disclosure orders. Derogations can only be justified in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice. Where justified, they should be no more than strictly necessary to achieve their purpose. This Court should carefully scrutinise any application for such derogations. They should be reviewed on the return date. The leading case is JIH v News Group Newspapers [2011] 1 WLR 1645, CA, see paras. 19 to 25. 18. There is ample support for a private hearing on an application relating to theft of confidential information and blackmail, see: PML, at para. 14; Ince at para. 4. See also XXX v Persons Unknown (no1) [2022] EWHC 1578 (QB), per Chamberlain J at para. 6; and Pendragon v Persons Unknown [2022] EWHC 2985 (QB), per Collins Rice J, at para. 3.”
[6]I have taken note of paragraph 39 of the Practice Guidance: Interim Non-Disclosure Orders [WB 2024, Vol 1, p 1975] which states that: It will not always be necessary for any parties to attend court on the return date: the hearing could be dealt with by the court on the papers, provided that sufficient material is before the court to enable scrutiny and effective case management to take place: see BCD v Goldsmith [2011] EWHC 674 (QB) at [60]-[62]. Any order should however be given in public and be publicly available.[7]While I do not consider that the Defendant’s Article 10 rights are engaged, I recognise that this injunction could have implications for freedom of expression rights more broadly in relation to reporting on the incident. S. 12(2) of the HRA 1998 provides that where the court is considering granting interim relief which might affect the exercise of the right to freedom of expression: (2) If the person against whom the application for relief is made (“the respondent”) is neither present nor represented, no such relief is to be granted unless the court is satisfied—(a) that the applicant has taken all practicable steps to notify the respondent; or(b) that there are compelling reasons why the respondent should not be notified.[8]Having considered the latest Witness Statement of Patrick Birchall, I am satisfied that the applicant has taken all practicable steps to notify the respondent. I note that the Claimant has also taken steps to notify other parties who have reported on the case of the order. Therefore s. 12(2) is satisfied.[9]I note the approach taken by Linden J on the return date in Armstrong Watson LLP v Persons Unknown (No 2) [2023] EWHC 921 (KB) [6] and by Hill J on the return date in University and College Union v Persons Unknown (no2) [2024] EWHC 2998 (KB) to decide matters on the papers. In light of the fact that the Defendant has not engaged at all, there has been no communication to the court from any other parties, and that there has been no material change in the underlying situation since the order of Soole J on 28 February 2025, I am satisfied that it is appropriate to take the same approach here and consider this application on the papers.[10]Given the sensitive nature of the data and the ongoing threat, I will keep references to the underlying facts of the case to the minimum required to support my reasoning in this short judgment. Service out of the jurisdiction[11]Soole J granted permission to serve the Claim Form and other documents out of the jurisdiction at the previous hearing. The Defendant provided a means of contacting it, including via a web portal with a facility allowing documents to bee uploaded. The uploading facility was not available by the time of the Order and the Claim Form were due to be served, therefore the Claimant’s experts sent an email to the web portal and included a link to a filesharing site where the documents were available. According to the evidence before me, it appears that this was an effective means of notifying the Defendant.[12]The Defendant has disabled the chat function on the web portal entirely since the order of Soole J. The particulars of claim were therefore served by email instead the Claimant has applied for validation of service by this route instead and retrospective amendment to the alternative service provisions.[13]This appears to be a reasonable approach to ensure effective service and continuation of the proceedings in light of what appear to be blocking tactics from the Defendants to prevent service. Merits of the application[14]This application relates to a cyber-attack involving theft of sensitive personal data and a request for ransom along with a threat to share the data more widely. Soole J considered that, in these circumstances, s. 12(3) of the Human Rights Act was not engaged. I agree with that analysis which aligns with authority in similar cases such as Armstrong Watson v Persons Unknown (No 1) [2023] EWHC 762 (KB), [2023] 4 WLR 41, [44]-[45].[15]According to Warby J in LJY v Person(s) Unknown [2017] EWHC 3230 (QB), [2018] EMLR 19, “28. Blackmail is defined by s 21(1) of the Theft Act 1968:
"A person is guilty of blackmail if, with a view to gain for himself or another .... he makes any unwarranted demand with menaces"
. The subsection goes on to explain that "a demand with menaces is unwarranted unless the person making it does so in the belief – (a) that he has reasonable grounds for making the demand; and (b) that the use of the menaces is a proper means of reinforcing the demand." 29. Generally, the Court has taken the view that blackmail represents a misuse of free speech rights. Such conduct will considerably reduce the weight attached to free speech, and correspondingly increase the weight of the arguments in favour of restraint. The Court recognises the need to ensure that it does not encourage or help blackmailers, or deter victims of blackmail from seeking justice before the court. All these points are well-recognized: see YXB [17]. It can properly be said that the grant of a privacy injunction to block a blackmail serves the additional legitimate aim of preventing crime.”[16]It is clear to me that the Defendants are not exercising any justifiable right to freedom of expression or seeking to add to legitimate public discourse. In a case such as this involving criminality and threats to reveal sensitive private information, I do not consider that the Defendant’s Article 10 rights are engaged.[17]The test for granting a continuation of the injunction is therefore that set out in American Cyanamid v Ethicon [1975] AC 396. In my view, there is clearly a serious issue to be tried, damages would not be an appropriate remedy given the sensitivity of the data involved, a cross-undertaking has been given, and the balance of convenience is plainly in favour of the grant of the order which is sought to contain potential damage in the absence of any engagement from the Defendants.[18]I note that, since the interim injunction granted by Soole J, there has been some correspondence between the Claimants and two sites which posted reports on the case in other jurisdictions and included screenshots of, or a link to screenshots of, a very small amount of the data. The Claimant informs me, in the evidence, that the site in Italy has since removed the articles, including the screenshots. The site in the United States which, on 5 March 2025 posted an article about these proceedings and, in particular, Soole J’s interim injunction, has not removed the article but the screenshots to which it linked has been taken down. The Claimant seeks no order from the Court in respect of these sites and therefore I am satisfied that their Article 10 rights are not engaged at this stage of the proceedings. Conclusion[19]Given the threats made by the Defendants and the sensitive nature of the data concerned, I am satisfied that a temporary injunction of this nature is in the interests of justice. I therefore make the Order as requested to continue the interim injunction.