Landmark Legal Case Highlights Value Of Injunctions In Cyber Attack Cases

• Published date: 22 November 2022
• Subject Matter: Insurance, Technology, Insurance Laws and Products, Security
• Law Firm: Weightmans
• Author: Mr Ed Lewis

A cybersecurity expert at national law firm Weightmans is calling for businesses and insurers to reconsider the value of 'persons unknown' injunctions...

A cybersecurity expert at national law firm Weightmans is calling for businesses and insurers to reconsider the value of 'persons unknown' injunctions in managing the fallout from cyberattacks, after successfully securing an injunction that preserved the claimant's anonymity and established a new point of case law.

In 'XXX vs Persons Unknown', the claimant was subject to a ransomware cyberattack that saw the theft of highly classified, security-sensitive information, much of which was protected by the Official Secrets Act. The stolen data was subsequently uploaded by the attacker to the Dark Web.

The legal team - led by Weightmans partner Ed Lewis, with supporting testimony from Weightmans partner Anthony Rance - successfully secured a permanent injunction in a summary judgment, restraining the defendants from using or distributing the claimant's confidential information.

Critically, the court also permitted the case to be heard in private, and for the identity of the claimant - a company providing technology-led solutions for security-sensitive and classified projects of national importance - to be withheld.

The judge - Justice Cavanagh - justified this decision on the grounds that there would be a real danger of malicious parties, including hostile nation states and terrorist organisations, seeking and exploiting the claimant's data if the claimant's name was exposed.

This rationale introduces a new point of case law, and grounds upon which future claimants may be able to preserve their own anonymity.

Commenting on the case, Edward Lewis, partner at Weightmans, said: "There's significant debate around the value of an injunction in cases of cyberattacks. There's always the risk that, by virtue...