Cyber Litigation

Hardly a day now passes without news of a cyber attack making the headlines. From airlines to supermarkets, from banks to professional firms, every sector of the global economy is vulnerable to ever more sophisticated cyber fraud, carried out by highly skilled attackers who are extremely difficult to identify.

There is much that organisations can do to address this threat: from investing in IT security in order to prevent attacks happening in the first place, to procuring cyber insurance and breach response services aimed at mitigating the immediate consequences of an attack. Those consequences may be proprietary, in the sense that they concern a loss of the victim’s own assets (for example, a redirection of funds following the introduction of malware, or a ransom payment in return for removing ransomware). Or they may concern third parties, such as regulators and customers or clients whose data has been accessed, all of whom may need to be notified within a short period of time. An urgent forensic exercise may need to be undertaken in order to shore up the victim’s IT defences and prevent another attack.

However, when the initial crisis has passed, different legal questions arise: such as whether it is possible to trace lost assets, if it is feasible to locate the perpetrators and claim damages or even how best to defend a Group Litigation Order. These are familiar questions, but with a technological spin that necessitates an innovative response. The recent announcement of a new court in London that will specialise in cybercrime, fraud and economic crime recognises this. But at the same time, the English Courts (at the prompting of litigants and their lawyers) are developing the existing procedural armoury to meet the challenges posed by modern communications and business.

The legal bases for the company’s claims, all of which succeeded, were as follows

• Claims for compensation for dishonest assistance, and in damages for unlawful means conspiracy, against those defendants who perpetrated the hack and against those defendants who knowingly assisted in the fraud. All of these claims also succeeded in full.
• A claim for knowing receipt against all of the defendants who received the company’s funds, whether directly or at a level (or two) removed. In relation to those defendants who received the company’s funds but did not actively participate in the fraud, they were found to have the requisite knowledge because they knew that the funds had been fraudulently obtained by deceit and illegal hacking, if not necessarily the identity of the victim.
• A restitutionary claim against the direct recipients of the company’s funds on the grounds of their unjust enrichment at the company’s expense.