The Court granted final injunctive relief by way of default judgment against unknown ransomware threat actors who exfiltrated approximately 280,000 files from a family law firm's servers, restraining further dissemination and requiring removal of the data from all internet locations. The Court confirmed that the equitable duty of confidence applies where a threat actor obtains data through unauthorised access with knowledge of its confidential nature, and that it would be oppressive to require individual itemisation of confidential documents where the volume is very large. Non-publication orders of varying duration (six months to five years) were made under the Court Suppression and Non-Publication Orders Act 2010 (NSW) to protect the identities of lawyers, experts and other individuals named in court documents, on the basis that publication would risk retaliatory action by threat actors and would deter future victims and their advisers from pursuing such proceedings.
The full text is available to signed-in members, including the 2 later cases that cite this judgment.