ZAB v Persons Unknown

MRS JUSTICE HEATHER WILLIAMS: This is the return date in relation to the interim injunction granted by Mrs Justice Collins Rice on 20 February 2026 following a without notice hearing. The claim relates to a ransomware incident in which the claimant's data appears to have been unlawfully exfiltrated by the defendant. The claimant was notified of the exfiltration by a ransom note received on 10 February 2026. The claimant did not engage with the demand in the note and some information was released on the dark web on 16 February 2026 as threatened. This included sensitive personal data.

Mrs Justice Collins Rice made orders restricting the defendant from using, publishing, communicating, or disclosing the exfiltrated information and requiring the defendant to deliver up and/or delete and/or destroy the information in its possession, custody or control, and to provide a witness statement explaining this and giving details of any disclosure to third parties. The defendant was also ordered to provide their full names and address for service.

Mrs Justice Collins Rice also granted anonymity to the claimant but required the claimant to serve evidence for the return date hearing if it sought the continuation of the grant of anonymity:

The defendant has not attended this hearing. At the outset, I directed that the hearing could proceed in the defendant's absence and that I would provide my reasons for this in my judgment, as I will come on to after I have summarised the material events that have taken place since the previous hearing. It has been possible to hold the entirety of this hearing in public.

Mrs Justice Collins Rice had before her the first witness statement of James Hyde, the partner with conduct of the case at Addleshaw Goddard LLP, the claimant's solicitors, dated 20 February 2026. For the purposes of this hearing, Mr Hyde has prepared a second witness statement, dated 16 March 2026. I have read these statements and also the transcript of the previous hearing.

The claimant attempted to serve the order made by Mrs Justice Collins Rice, the application notice and the claim form by the alternative method of service permitted by that order. This proved unsuccessful for reasons it is unnecessary for me to detail, but which are set out in the evidence I have seen. The documents were then sent instead via an available email address. This prompted a reply from the recipient, stating that the claimant's response was too slow. This indicates that the email address in question was being monitored.

Apart from sending the message I have just referred to, the defendant has not engaged with the claimant and has not complied with the injunction orders.

Particulars of Claim were sent to the defendant via the email address I have referred to on 16 March 2026. On the same date, an application notice for this hearing was issued. This was less than three clear days in advance of the hearing. The application notice sought the following: (1) time for service of the application to be abridged; (2) an extension of the interim prohibitory injunction; (3) directions; (4) a continuation of the derogations from open justice, including in relation to anonymity; and (5) an order for retrospective permission for alternative service by a different method to that set out in the 20 February 2026 order.

The court has a discretion to proceed in the absence of a defendant, see CPR 23.11. I have also had regard to section 12(2) of the Human Rights Act, although it is debatable that that section is engaged in the present kind of circumstances.

I am satisfied that the tests are met and that it is appropriate to proceed. I am satisfied that the 20 February 2026 order was received by the defendant by the means I have referred to. It therefore follows that the defendant was aware of this hearing.

There is every indication that the defendant's non-involvement is deliberate. It is in keeping with the conduct which prompted this claim to be made. I also bear in mind that the defendant's position is protected by the provision in the order I will make that allows it to seek a discharge or variation of this order.

As I have indicated, the claimant seeks an order retrospectively validating service that has taken place, and permitting the same method of alternative service going forward.

Alternative service may be permitted pursuant to CPR 6.15 read with CPR 6.27. CPR 6.15(2) reads:

I am satisfied that this is an appropriate course to take in the circumstances. There is good reason to make the order sought, given the claimant has tried to serve the defendant via the method directed in the 20 February 2026 order but was unable to do so for matters beyond the claimant's control. Further, given that a response was received from the email address I have referred to, I am satisfied that service by this method meant that the documents are likely to have come to the defendant's attention and are also likely to do so if this method is used in the future.

Retrospective alternative service was ordered by Mrs Justice Hill in a similar ransomware case, University and College Union v Persons Unknown [2024] EWHC 2998 KB.

I have suggested a minor amendment to the draft order covering this aspect, in order to clarify the documents which are covered by this direction for alternative service and Mr Speker KC accepts this is appropriate.

As I have indicated, the claimant also seeks an order pursuant to CPR 23.7(4) abridging time for service of the application notice issued on 16 March 2026. I accept the explanation provided in Mr Hyde's second witness statement, and I am willing to grant the order sought in this respect. No prejudice is caused to the defendant given it has not engaged with the proceedings at all, and has failed to comply with the mandatory injunctions made at the previous hearing.

The claimant's draft order sets out standard terms for the interim injunction sought at this stage, restraining the defendant from using, publishing, communicating or disclosing the claimant's confidential information or making it available to be accessed. The claimant's claim as set out in the claim form and the particulars of claim is for breach of confidence. I am satisfied from the material provided that the claimant has a strong case for showing that the defendant came into possession of confidential information held by the claimant through the defendant's unlawful actions and for the purposes of commercial gain.

The claimant's confidential information remains in the possession of the defendant, who should not have it and who knows it should not have it, who has not returned it, and has sought to make aspects of it available on the dark web and not removed it, even though it has been served with a court order. Additionally, the defendant has not complied with the mandatory order to deliver up the material.

In the circumstances, the test for the grant of interim relief identified in American Cyanamid v Ethicon [1975] AC 396 is clearly met. The claimant has shown there is a serious issue to be tried, damages would be an inadequate remedy, and the balance of convenience plainly lies in the claimant's favour.

I am satisfied that the continuation of the interim junction is necessary and justified. If section 12(3) of the Human Rights Act applies, I am also satisfied the claimant is likely to establish its case at trial.

There are statements made in various cases involving Persons Unknown requiring claimants to bring such actions to a conclusion, see for example Brett Wilson LLP v Persons Unknown [2016] 4 WLR 69 at paragraph 11.

The claimant has proposed directions at paragraphs 5 - 8 of the draft order designed to conclude the claim. These directions provide for the filing and service of the Defence and Reply. If the defendant does not serve a Defence, the claimant is required to take such steps as it is advised to conclude the action, including but not limited to applying for default and/or summary judgment by the same date as any Reply would be due. There is also provision made for the steps that the claimant must take if it wishes to obtain wider injunctive relief having effect against any non-party served with the order.

I am satisfied that this part of the draft order meets the requirement for the claimant to take appropriate steps to bring the action is to a conclusion, and therefore I am willing to grant directions in these terms.

Two derogations are sought: first, restrictions on access to documents to the defendant and to third parties. This only relates to confidential schedules and exhibits and confidential witness statements, and I accept such restrictions are appropriate in a case of this kind. As regards the defendant, these restrictions only apply until the defendant provides a name and address for service, and I am satisfied this is an appropriate order to make in the circumstances. An equivalent order was made in the ransomware case of Armstrong Watson LLP v Persons Unknown (no 1) [2023] EWHC 762 KB at paragraph 54.

Secondly, the claimant seeks continued anonymity for the claimant. At the hearing before Mrs Justice Collins Rice, the claimant applied for anonymity for the reasons set out at paragraphs 37 - 39 of Mr Hyde's first witness statement. I have already referred to the terms of paragraph 15 of the order made by Mrs Justice Collins Rice. Mr Hyde's second witness statement addresses anonymity at paragraphs 13 - 36.

I will summarise the points he makes. First, he describes the extensive efforts made so far to identify the exfiltrated data and the difficulties that have been encountered in doing so. Secondly, he explains that the defendant remains in possession of the exfiltrated data and it is not known, as yet, whether or not it has all been published or just a proportion of it. Thirdly, he explains the data is likely to include special category data or sensitive information relating to individuals, including references to passports, health conditions, religion, dates of birth, bank account numbers and passwords. Fourthly, he explains why it has not been possible to identify and therefore warn all those who are potentially affected. Fifthly, there is no guarantee the defendant will not strike again, since it has shown an unwillingness to comply with the court orders. Sixthly, he expresses the concern that identifying the claimant will pose a very real risk that individuals will then search for the information stolen and this in turn is likely to encourage the defendant to publish more of the exfiltrated material, with the potential consequential impacts on the data subjects, including distress and reputational damage. Seventhly, he also expresses the concern that identifying the claimant could encourage other malicious actors to target the claimant or other individuals whose data has been compromised.

I remind myself of the relevant principles. The Practice Guidance on Interim Non-Disclosure Orders at paragraphs 9 - 15 confirms that open justice principles apply in this context. Derogations can only be justified in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice. Where justified, they should be no more than strictly necessary to achieve their purpose. The courts should carefully scrutinise any application for such derogations, JIH v News Group Newspapers [2011] 1 WLR 1645 at paragraphs 19 - 25. It is well established by the case law that the names of parties to litigation are important matters that should usually be available to the public.

The court has an inherent common law power, reflected in CPR 39.2, to derogate from the principles of open justice in civil proceedings by making anonymity orders where it is strictly necessary in the interests of justice; see PMC v Cwm Taf Morgannwg University Health Board [2025] EWCA Civ 1126, [2025] 3 WLR 887 at paragraphs 85 and 101, and JIH v News Group Newspapers at paragraphs 19 - 25.

At paragraph 108 in the PMC case, the Master of the Rolls observed that in A v British Broadcasting Corpn [2014] UKSC 25, [2015] AC 588, Lord Reed had made the following important points:

In ZAM v CFW [2013] EWHC 662 QB, [2013] EMLR 27, Tugendhat J said at paragraph 44:

As Mr Speker points out, anonymity has been granted to corporate claimants who have been victims of blackmail or possible attempts following hacking incidents for a variety of reasons, and he cited the following examples:

In XXX, anonymity was granted to the claimant at the interim injunction stage, and when hearing the claimant's application for summary judgment, Cavanagh J decided to continue the grant of anonymity. Having reviewed the authorities, he summarised the position as follows at paragraph 24:

In deciding to extend the grant of anonymity, Cavanagh J noted that the mere fact that a business would be likely to suffer negative commercial and/or reputational consequences were the attack to became public knowledge, was not automatically a sufficient reason to make an anonymity order. He said that there must be something in particular which justifies anonymity or any other derogation from the principle of open justice (see paragraph 26). The justification in that case lay in the nature of the security-sensitive work undertaken by the claimant, coupled with the concern that if the identity of the claimant was disclosed, it would prompt third parties with malign intent to seek to make contact with the blackmailers or to try to seek out the stolen information on the dark web themselves (paragraph 28). Thus, identifying the claimant would advance the objective of the defendant (paragraph 29).

There are some, although not exact, parallels with the present case. The main difference being the officially sensitive nature of the information in that instance. There are also parallels with the other cases I have referred to that Mr Speker cited.

Mr Speker also very properly drew my attention to R v Nigel Wright (Ruling on Anonymity) [2020] EW Misc 22 as an case where anonymity was not granted to a corporate victim of blackmail.

In that case, the allegations of blackmail were that on three occasions, the defendant made written demands for money to a major supermarket chain, accompanied by a claim that contaminated food had been placed in stores; and threats that if the money was not paid, the locations would be kept secret or further contaminated goods be placed in stores, or both. Warby J, as he then was, declined to order anonymity for the supermarket chain or reporting restrictions at Wright's criminal trial on the basis that this was not a "classic" case of blackmail in which the victim is an individual and is being blackmailed on the basis that she or he "has something to hide", so it did not engage the same policy considerations as blackmail involving a threat to disclosure wrongdoing or embarrassing facts of a personal and private nature in respect of natural persons. He also noted that the complainant was not an individual with Article 8 ECHR rights and that nobody had suggested the complainant had done anything disreputable or discreditable or had anything to hide. The threat was to disclose the fact that the complainant had been the target and victim of criminal acts and might be the target and victim of further such acts. Warby J was not persuaded that the administration of justice required anonymity in cases of that kind. See in particular paragraphs 43 to 46 of his judgment.

However, Warby J accepted at paragraph 43 that there may be cases involving corporate blackmail where the interests of justice do require the grant of anonymity. I accept Mr Speker's submissions that the present case is very different. In Wright, the events were historic, the underlying material was not sensitive as is the position here, and individuals were not affected in that case in contrast to the likely position in the present case. It is right I take account of the Article 8 rights of those individuals here, as, for example, Sheldon J did in HCE v UEH.

In all the circumstances and in light of the particular considerations identified by Mr Hyde which I have summarised, I am satisfied that it is necessary in this case to order the continuing anonymity of the claimant to protect individual third parties and so as to ensure that blackmail is not encouraged or rewarded. Similarly, I am satisfied that the proposed intrusion upon open justice is no more than is necessary in the circumstances.

I have indicated to Mr Speker that an addition should be made to the draft order to spell out that the withholding of the claimant's identity will continue.

The other terms of the draft order are in standard form and it is unnecessary for me to go through it them in this judgment.

I will make an order in the terms sought, subject to the tweaks and additions I have discussed with Mr Speker during the course of this hearing.

Thank you very much. Epiq Europe Ltd hereby certify that the above is an accurate and complete record of the proceedings or part thereof.