The University of Notre Dame Australia v Persons Unknown

This is an application for leave to proceed and for default judgment against defendants who have not been personally named because their identities are unknown. I set out in the following paragraphs some background factual matters that have been established on evidence that has not been challenged.

The University of Notre Dame Australia is a national Catholic university. It is a body corporate established by the University of Notre Dame Australia Act 1989 (WA). The University has become the victim of an extortion attempt. In January this year, in excess of 60 GBs of data, comprising some 60,000 files, were stolen by unnamed extortionists. Many of the files contain confidential information concerning the University’s internal operations, as well as the records of students, staff and faculty members.

The extortionists operate under the name “Fog”, who I will refer to as the threat actor. It is not certain whether there is just one person who is seeking to extort money from the University or whether there are multiple persons involved. The evidence suggests there is more than one person. There is evidence that the members of Fog are likely to reside in the United States and countries throughout Europe.

On 25 January 2025, a ransom note was discovered on the University’s computer system. The message included the following: “If you are reading this, then you have been the victim of a cyber-attack. We call ourselves Fog and we take responsibility for this incident”. The note indicated that to contact Fog, so as to “communicate safely”, it was necessary to have the TOR browser installed, to follow a link that was provided and then enter a particular code. There is evidence that a link in the ransom note leads to a data leak site run by Fog that is used to publish the names and captured data of victims if they fail to pay the ransom. The publication occurs on the “dark web”, which is a part of the internet that is not readily accessible by everyday individuals.

The University engaged [redacted], a forensic investigation expert, and [redacted], a threat intelligence provider, to assist the University to address the cyber-attack.

With the assistance of the threat intelligence provider, the University opened the line of communication via the link provided by the threat actor. The forensic investigation expert was able to confirm that data had been exfiltrated from the University’s computer servers by the threat actor, although it has not been able to verify what data has been exfiltrated.

On 4 February 2025, the threat actor communicated an initial ransom demand. It was in the following terms: “Bosses demand is 1.2mil usd. you lost many personal files”.

On 12 February 2025, the threat actor posted on its data leak site, identifying the University as a victim. The post alleged that it had extracted 62.2 GBs of data, containing employee and customer contacts, student medical documents as well as confidential agreements, licenses and nondisclosure agreements.

The students who attend the University, and the faculty and staff who work there, entrust the University with confidential information and engage in confidential communications with the University about personal and educational matters. The University sought to curtail the damage, and prospective damage, that will be suffered by the University, students, faculty and staff by the unauthorised dissemination of confidential information by commencing proceedings in this Court on 18 February 2025.

The University obtained urgent ex parte interlocutory injunctive relief from the Court on 18 February 2025 against “persons unknown”. The interlocutory injunction was extended by the Court on 20 February 2025 and it remains in place.

To date, the University has not paid any ransom. As far as the University is aware, the threat actor has not carried out the threat to publish any of the exfiltrated data. There have been media reports of the fact of the incident.

By notice of motion filed on 7 April 2025, the University seeks leave to proceed pursuant to UCPR r 11.8AA and final relief by way of default judgment pursuant to UCPR r 16.10 against the defendants, who are referred to as “Persons Unknown”.

For the reasons that follow, I will give leave to proceed and default judgment.

The circumstances of this case are similar to those considered by Slattery J in HWL Ebsworth Lawyers v Persons Unknown (2024) 113 NSWLR 418; [2024] NSWSC 71. The clear articulation of principle in that matter is of considerable assistance, relieving me of the task of setting out the relevant principles in detail, and enabling me to be relatively brief in giving my reasons. There are some minor departures from what was ordered in that case, which I address in the reasons below.

On 18 February 2025, Williams J made orders for substituted service. Pursuant to those orders, the filed (redacted) statement of claim, supporting affidavits and other documents were served. Service occurred in accordance with those orders by sending the documents using the TOR browser in the link provided by the ransom note. The communication included a Dropbox link permitting the redacted documents to be downloaded. The Court can be satisfied that the communication was successful because there was a response with the message: “i see ok”.

On 20 February 2025, the interlocutory orders made on that day were served via the TOR browser. There was a response as follows: “no I am not interested”.

On 21 February 2025, the threat intelligence provider re-served the redacted statement of claim and served a customised Form 161 notice. A Form 161 notice must be served when an originating process is served on a defendant who is ordinarily resident outside of Australia – see UCPR r 11.7. The form was re-served because the notice served on 18 February 2025 had not been completed properly; in particular, it failed to identify the grounds alleged by the University to support its claim to be entitled to serve the defendants outside Australia. The 21 February 2025 communication provoked the following response: “ok”.

The location of the defendants is unknown. It is likely, however, that they are outside Australia. The University has proceeded on that basis and it is appropriate that it has done so.

UCPR r 11.8AA provides as follows:

It follows that the first thing the University requires before it can obtain default judgment is leave to proceed.

UCPR r 11.8 provides:

I am satisfied that the defendants have been served with the statement of claim in accordance with the orders of the Court and have notice of the claim. They were first served on 18 February 2025 (and again on 21 February 2025) and had 42 days to file an appearance. No appearance has been filed.

The statement of claim gave notice to the defendants that if they did not file a defence within 28 days of being served, they will be in default and the Court may enter judgment against them without any further notice. It seems peculiar that a defendant served outside Australia has 28 days to file a defence but 42 days to file an appearance, but that does not matter for present purposes.

The notice of motion filed on 7 April 2025 has not been served. In HWL Ebsworth, the notice of motion for the entry of default judgment was served in accordance with orders of the Court (see [24]). However, UCPR r 11.8AA(2) expressly provides that an application for leave under r 11.8AA(1) may be made without notice. Furthermore, r 16.3(1A) provides that an application for default judgment need not be served on the defendant. It is appropriate for the Court to proceed on the present application notwithstanding that the notice of motion has not been served.

There is a question about whether there are other matters that must be established by the University in order to be granted leave to proceed. In Bulldogs Rugby League Club Ltd v Williams [2008] NSWSC 822, Austin J referred to the decision in Agar v Hyde (2000) 201 CLR 552 and said (at [29]) that: “Other cases – and Agar v Hyde itself – indicate that there are essentially four matters to consider in an application for leave under r 11.4” (r 11.4 was relevantly in the same terms of what is now r 11.8AA). The “four matters”, addressed at [30]-[34], were: (1) proof of proper service; (2) whether the claim falls within Schedule 6 of the UCPR; (3) whether the plaintiff has an arguable case; and (4) whether the local forum is “clearly inappropriate” and there is some other forum that is more appropriate. The same four matters were identified in Rossiter v Core Mining Ltd [2015] NSWSC 360 at [11] and Western Sydney Local Health District v Jaca [2017] NSWSC 1626 at [5].

I have difficulties seeing how those three decisions are consistent with the reasons of the plurality in Agar v Hyde. In those reasons, the plurality pointed out at [53] that it is necessary to recall “that there are different issues raised on the hearing of an application for leave to proceed from those that arise on the hearing of applications to set aside service or to decline to exercise jurisdiction”.

Their Honours identified the issues raised on the hearing of an application for leave to proceed at [54] as follows:

In Agar v Hyde at [55], the plurality’s reasons move to the different issues that arise in an application to set aside service, or an application to have the Court decline to exercise jurisdiction. That is where the reasons identify matters (2) to (4) that Austin J addresses in Bulldogs Rugby League Club v Williams at [30]-[34], although not as an “exhaustive description”. Paragraph 55 addresses applications under Pt 10 r 6A, which concerned orders setting aside an originating process. One matter the rule expressly provided for as a ground for setting aside an originating process was that “this Court is an inappropriate forum for the trial of the proceedings”. This is now the subject of UCPR r 11.6, which provides as follows:

It also seems clear from [53] in Agar v Hyde that the plurality contemplated that on an application for leave to proceed that occurs without serving the notice of motion on the defendant, there is no occasion to consider any question about the strength of the plaintiff’s claim, which is hard to reconcile with matter (3) identified in Bulldogs Rugby League Club Ltd v Williams.

On an application such as this one – where the defendant has not appeared and is not present, and where there is not going to be a trial, questions about the strength of the University’s claims do not appear to arise as a relevant consideration. It is also hard to see why questions of whether the Court is an inappropriate forum arise, especially in a case such as this one, where there is not going to be a trial. Generally speaking, the consideration of whether the forum is clearly inappropriate will focus on the oppression and vexation faced by the defendant who will be compelled to come to the local forum for the determination of the dispute. A defendant who has chosen not to appear, and so has chosen not to participate in the determination of the dispute, will not be oppressed or vexed by having to come to New South Wales.

That is, in the reasons in Agar v Hyde at [54], the plurality was addressing the subject of applications for leave to proceed, which is now the subject of r 11.8AA. At [55], the plurality was addressing applications to set aside service, or to dismiss or stay the proceedings, which is now the subject of r 11.6. The four matters identified in Bulldogs Rugby League Club v Williams, Rossiter v Core Mining and Western Sydney Local Health District v Jaca are addressed by the plurality in Agar v Hyde in connection with an application to set aside service or to dismiss or stay the proceedings – not in connection with an application for leave to proceed.

In my view, Agar v Hyde compels the conclusion that when the Court considers an application under r 11.8AA, leave should be granted if:

In this case, there has been proof of service. The statement of claim seeks an injunction to compel or restrain the performance of any act in Australia, which engages r 11.4, because Schedule 6 row (d)(i) is engaged: see X v Y & Z [2017] NSWSC 1214 at [11]-[12]; X v Twitter Inc (2017) 95 NSWLR 301; [2017] NSWSC 1300 at [20]. The claim also relates to property in Australia, engaging Schedule 6(e): see HWL Ebsworth at [21]. I cannot see any countervailing considerations that suggest that leave should not be granted. There may be cases where Schedule 6 is engaged in a manner that can be said to be a merely colourable attempt to engage the jurisdiction the Court, in which case leave should not be granted. That is not the case here.

I also observe that it was probably unnecessary for the University to satisfy the Court that the originating process, on its face, reveals that the claim engages r 11.4. That is because on 18 February 2025, the Court gave leave (should it have been required) for the statement of claim to be served pursuant to r 11.5 (which concerns service by leave when it is not allowed under Schedule 6).

While it seems to me that having regard to the wording of r 11.8AA, and in light of the reasons in Agar v Hyde, I am not required to consider whether the plaintiff has an arguable case or whether the local forum is clearly inappropriate, I recognise that there is authority to the contrary (as noted above). Accordingly, I have considered whether the University has an arguable case and whether the local forum is clearly inappropriate. Having regard to the pleaded case and the evidence before me, the University has a strong case (see further below) and this Court is plainly an appropriate forum to seek to obtain injunctive relief in respect of conduct throughout Australia, including New South Wales. The University’s servers that were hacked included servers located in Sydney. The University also has a campus in Sydney. I would infer that there is a likelihood that at least some of the natural persons who are potentially affected by the exfiltration of data reside in New South Wales.

Accordingly, I will grant leave under UCPR r 11.8AA for the University to proceed against the defendants.

The next matter is whether the University should have default judgment.

UCPR r 16.10 provides:

The first thing to consider is whether the defendants are “in default”.

UCPR r 16.2(1)(a) relevantly defines “in default” as follows:

UCPR r 14.3(1) provides:

More than 28 days has passed since the defendants were served. They are relevantly “in default”.

Having secured leave to proceed, and having shown that the defendants are in default because no defence has been filed in accordance with UCPR r 14.3, under r 16.10, the Court may give such judgment against the defendants as the University appears to be entitled to on its statement of claim.

The pleaded case, which is also supported by affidavit evidence, is a compelling one. It pleads that the defendants exfiltrated a large amount of data from the University’s servers located in New South Wales and Western Australia that is likely to contain confidential information. The defendants have attempted to extort the University, so far by a demand of USD$1,200,000. The extortion carries the threat that stolen confidential information will be publicised in some fashion. The statement of claim pleads:

The statement of claim does not in terms plead a cause of action or identify a particular legal right that it seeks to vindicate. But that does not involve any criticism. UCPR r 14.7 requires the pleading to contain only a summary of the material facts on which the University relies. It is apparent that the University contends that the defendants hold information that is, or is likely, to be confidential to the University and others to whom the University owes duties of confidence, that the defendants hold this information without authorisation and they threaten to misuse the confidential information.

The University seeks by these proceedings to protect the confidence in the information that has been taken. The pleaded case is that the defendants have sought to rely on the confidential nature of the information, taken without authorisation, to extort money from the University, and have taken steps to ensure their identity and location cannot be detected (revealing a consciousness of wrongdoing). It is a straightforward matter for a court of equity to conclude that the defendants would have an obligation of conscience to keep the information confidential: Moorgate Tobacco Co Ltd v Philip Morris Ltd (No 2) (1984) 156 CLR 414 at 438 per Deane J. It is unnecessary to focus keenly on the importance of the information; equity would respond to the surreptitious manner in which the information was obtained: Lord Ashburton v Pape [1913] 2 Ch 469 at 475. There is exclusive equitable jurisdiction to grant relief against a threatened abuse of confidential information. This case involves such a threatened abuse, because the attempted extortion depends upon it. Relief in similar circumstances was granted in HWL Ebsworth. See also Armstrong Watson LLP v Person(s) Unknown [2023] EWHC 1761.

The University seeks relief against the defendants, who are Persons Unknown. The Persons Unknown are defined in the statement of claim as follows:

The Court retains a discretion as to whether to give default judgment pursuant to UCPR r 16.10.

I accept that the grant of an injunction has utility, for the same reasons it was considered to have utility in HWL Ebsworth. Whether an injunction will be obeyed by the defendants is not known. They have shown themselves to be willing to engage in criminal behaviour and their identities remain unknown. But a defendant’s disdain for legal process is not a reason for the Court to decline to exercise its jurisdiction. An injunction also has utility because it will be useful for notification to potential publishers of the data to reinforce that they should not take steps to frustrate the effectiveness of the Court’s orders. It will also enable the University to inform online platforms which are at risk of publishing the material of the orders.

I see no reason why the discretion should not be exercised in the University’s favour. I would describe the University’s entitlement to injunctive relief on a default basis using the same word used by Collins Rice J in Armstrong Watson LLP v Person(s) Unknown at [22]. It is irresistible.

The form of orders that the University seeks are similar to those made in HWL Ebsworth.

There are two departures of note.

The first is that the injunction in HWL Ebsworth was expressed as follows: “The Defendants as defined below (and any other third party in possession of the Impacted Dataset that is made aware of these orders) is restrained from…” As so framed, the injunction could be read as extending, from time to time, to third parties who are not parties to the proceedings. The University seeks an injunction in a more conventional form, as follows: “The Defendants (by themselves, their agents, or by any third party in possession of some or all the Exfiltrated Dataset) be restrained from…” This makes it clear that the injunction lies only against the defendants, but recognises that they may act through other persons. In Sigalla v TZ Ltd [2011] NSWCA 334, Young JA (with whom Macfarlan JA and Handley AJA agreed) observed (at [13]): “that when an order is made injuncting X by himself, his servants or agents, that that is not an order against the servants or agents but merely a warning that if they knowingly assist X in the breach of the injunction, they may be in trouble”. The words “or by any third party in possession of some or all the Exfiltrated Dataset” in the proposed order may be less conventional. However, it is appropriate in this case because it recognises the different ways that the defendants may act. It is common for injunctions to be expressed in terms on an injunction against persons “by their servants, agents or otherwise”. The wording of the injunction sought by the University gives more specific and helpful content compared with the more general words “or otherwise”. I consider the framing of the injunction as proposed by the University is preferable to the form of order made in HWL Ebsworth.

The second is that the University seeks a mandatory injunction that: “The Defendants take all steps to immediately remove all and any of the Impacted Dataset (including the Exfiltrated Dataset) from all accessible internet locations (including, for the avoidance of doubt, from ‘dark web’ locations)”. No such order was made in HWL Ebsworth, although it appears that no such order was sought. Slattery J did not expressly decline to make such an order. There is no evidence that any of the Impacted Dataset is available on any accessible internet locations. However, the character of the extortion means that it is conceivable that some of the information is accessible to some extent in some locations, including the dark web. I am prepared to grant an order of this kind.

On 18 February 2025, Williams J made a non-publication order pursuant to s 7(b) of the Court Suppression and Non-publication Orders Act 2010 (NSW). Those orders prohibited, until further order, the publishing of certain information that was included in documents that were served on the defendants. The redacted information comprised:

The grounds for the order (see s 8(2) of the Suppression Act) were that:

The University seeks a final non-publication order under s 7(b) of the Suppression Act, extending the order made by Williams J on 18 February 2025. The application concerns the same information and relies on the same grounds. It seeks an order for a duration of 3 years. The University also submitted that if the Court decides to publish reasons, it would be proper to refrain from disclosing in the reasons matters that are the subject of the non-publication order: see DRJ v Commissioner of Victims Rights [2020] NSWCA 136 at [50]. The University seeks non-publication and suppression orders in relation to that information.

I am not prepared to make any final orders under the Suppression Act at this time. There is a public interest in the publication of these reasons and I propose to publish them. However, in the first instance I will make the reasons available only to the University and will make interim non-publication and suppression orders pursuant to s 10 of the Suppression Act. I consider that interim orders are necessary to prevent prejudice to the administration of justice. I will give the University 7 days to identify those parts of the reasons that it contends are properly the subject of non-publication and suppression orders and to make an application for appropriate orders. That application should also extend to the balance of the material before the Court, identifying with precision, the material that is the subject of the application. I have in mind that the application will, for example, identify the specific parts of the affidavits that are to be the subject of the orders (rather than merely to describe the general character of the material that is the subject of the orders). It should not be assumed that the matters that were the subject of non-publication orders on 18 February 2025, in the context of urgent ex parte relief, will be presumed to be the proper subject of orders, given the passage of time and the circumstances that now exist. I propose to reconsider the manner in which the Suppression Act applies in this case.

The question of final non-publication and suppression orders, including with respect to these reasons, will be addressed, afresh, and as a matter of urgency, by reference to that application.

I make the following orders:

The plaintiff made an application for orders under the Court Suppression and Non-publication Orders Act pursuant to the order set out at [60(6)] above. On 24 June 2025 I made final orders under that Act.

Those orders address particular parts of the evidence and submissions that were relied upon in these proceedings. In addition, non-publication orders were made in respect of these reasons. Relevantly for the purposes of these reasons, the non-publication orders extend to the identity of the following entities who were retained to assist the plaintiff in relation to the subject of these proceedings: (1) the forensic investigation expert, (2) the threat intelligence provider, and (3) the solicitors. The order is in operation for 3 years from 24 June 2025. A redacted form of the judgment will be published by the Court, consistently with those orders.

A redacted form of the orders made today will also be published. The unredacted form of the orders will be maintained with the Court file.