Recently, the Supreme Court of New South Wales handed down judgment in HWL Ebsworth Lawyers v Persons Unknown [2024] NSWSC 71. Perhaps peculiarly, the Court granted injunctive relief against the defendants – a group of persons unknown at the time of judgment. This case note unmasks how – and why – a court may make orders against an unknown person and identifies why such orders may be of growing importance.

The ‘exfiltration’ giving rise to the application

In April 2023, HWL Ebsworth (HWLE) received an email from a group known as “Blackcat”, in which it was alleged that Blackcat had infiltrated HWLE’s systems and extracted up to 4TB of confidential data. Blackcat threatened to publish the information should HWLE not provide the ransom demanded.

In June 2023, the Supreme Court granted interlocutory injunctive relief against the defendants, classified by HWLE as a class of “those persons who carried out or participated in the unauthorised exfiltration of computer files from the plaintiff’s file storage systems.” The injunction restrained the defendants from, among other things, disclosing or publishing the data without the consent of HWLE.

HWLE then sought orders making final the interlocutory injunction.

Judgments against ‘persons unknown’?

After considering the procedure through which HWLE served the Statement of Claim on foreign persons unknown, and affirming the Court’s power to order injunctive relief for breaches of confidence, Slattery J turned to a key issue in the circumstances of the case – is such relief available against ‘persons unknown’?

The Court first looked overseas, identifying several instances in the United Kingdom where courts have made orders against persons unknown. A number of Australian cases were also considered relevant where, despite not relating to data breaches, courts have exercised jurisdiction to make orders against unknown persons.

However, as made clear in Maritime Union of Australia v Patrick Stevedores Operations & Anor (1998) 4 VR 143, injunctive relief is not available against the world at large. Naturally, such a prohibition proves relevant for an applicant seeking an injunction against a person or persons they cannot identify; and one which required consideration by the Court.

If the defendants, although unidentified, can be described as a group or class of persons with sufficient precision, the Court may provide injunctive relief. Here, Slattery J found that HWLE, in defining the defendants as “those persons who carried out or participated in the unauthorised exfiltration of computer files from the plaintiff’s file storage systems”, was sufficiently precise as to make clear that it was not seeking an injunction at large.

Ultimately, the Court granted HWLE injunctive relief restraining the unknown defendants from disclosing or publishing the data obtained from the breach.

Takeaways

Slattery J stated that the granting of an injunction against ‘persons unknown’ has utility. Yet one would be wise to query whether such utility exists in a real and meaningful sense; or whether, when considering the costs incurred by HWLE in making the application to the Supreme Court, the injunction is even worth the paper it is written on.

Often in cases such as this, the ‘persons unknown’ are in an undisclosed location outside of Australia. By their very nature, ‘persons unknown’ prove very difficult, if not impossible, to enforce a judgment or costs order against. For this reason, commentators have sometimes described judgments against ‘persons unknown’ as a ‘pyrrhic victory’ for applicants.

However, Slattery J identified that injunctive relief does provide some benefit to victims of data breaches. HWLE will be able to use the injunction to inform online publishers, who may fall into possession of the data, of the orders, preventing further dissemination. The impact of this should not be understated – particularly in a world where a business’ reputation largely depends on their online brand.

Not only this, but the impact of a judgment such as this extends beyond the immediate circumstances of a case – for justice must not only be done but must also be seen to be done. Judgments against unknown persons are as much a remedy for the particular victim as they are a statement that the Court will not treat differently a perpetrator who is (at judgment) anonymous.

The fact that courts have displayed a willingness to make orders against ‘persons unknown’ will only continue to garner relevance as the world moves into a new age of technology. For businesses that transact, store information and communicate extensively by way of technology, there is comfort in the fact that such orders can help to minimize third-party resharing of data.

And, should the unknown defendants suffer from a sudden change of heart, perhaps such injunctions will prevent distribution of the extracted data in the first place.