ICAEW.com works better with JavaScript enabled.

Case law: Company successfully stops hackers who stole data and demanded a ransom to stop them publishing it

Businesses who have been hacked and had data stolen have access to remedies that can severely discourage and undermine the hackers if they threaten to publish it online, provided they act quickly, a recent case makes clear.

July 2018

This update was published in Legal Alert - July 2018

Legal Alert is a monthly checklist from Atom Content Marketing highlighting new and pending laws, regulations, codes of practice and rulings that could have an impact on your business.

A company's servers were hacked and its data stolen. The hacker demanded £300,000 or they would make the data public. As proof they had the data they directed the company to a password-protected website, and gave the company the password so it could verify that the data had been stolen and could be made publicly available.

The company strung out negotiations with the hacker. In the meantime, it obtained an interim injunction for delivery up and/or destruction of the data. The High Court restricted access to the court file, dealt with the application on an ex parte basis (ie without involving the hacker) and anonymised the company's identity, to prevent the hacker finding out and publishing the data anyway.

The company also investigated where the website was being hosted (it was in another EU country), and also obtained an injunction in that country, requiring the host to block access to the hacker's website.

When the injunctions were served on the hacker, the hacker started posting the data on other websites. The company was then able to serve copies of the injunctions on the hosts of those sites, and the data was taken down in each case.

A fortnight later, the ransom demand was reduced to £100,000. By the time of the hearing to decide whether to continue the injunction, the hacker seemed to have given up. The Court nevertheless continued the injunction.

Operative date

  • Now

Recommendation

  • Businesses who have been hacked have remedies available that can severely discourage and undermine hackers who have stolen data from them and are threatening to publish it online, provided they act quickly

Case ref: PML v Person(s) Unknown [2018] EWHC 838

Disclaimer: This article from Atom Content Marketing is for general guidance only, for businesses in the United Kingdom governed by the laws of England. Atom Content Marketing, expert contributors and ICAEW (as distributor) disclaim all liability for any errors or omissions.

Copyright © Atom Content Marketing