Australian Medical Association (WA) Incorporated v Persons Unknown

These reasons concern the plaintiffs’ notice of motion filed on 9 February 2026 seeking leave to proceed pursuant to r 11.8AA of the Uniform Civil Procedure Rules 2005 (NSW) (UCPR), injunctive relief on a final basis by way of default judgment, non-publication orders pursuant to the Court Suppression and Non-Publication Orders Act 2010 (NSW), and an order restricting access by news media organisations to parts of the court file.

Following a hearing on 20 February 2026, I made orders in the terms sought by the plaintiffs and reproduced in Annexure A hereto on the basis that my reasons for doing so would be published as soon as practicable. These are those reasons.

The following account of the factual matters relevant to the application are drawn from the plaintiffs’ evidence, which has not been challenged as the defendants have not appeared.

The Australian Medical Association (WA) Incorporated is the first plaintiff in these proceedings. It is an independent professional organisation for medical practitioners and medical students in Western Australia. The second to seventh plaintiffs are related entities, all of which are controlled by the first plaintiff and which provide a variety of services and products to members of the medical profession and the general public (including insurance broking and mortgage broking services) and offer traineeship programs in aged care and certain other health services. In these reasons, I will refer to the plaintiffs collectively as AMA WA.

AMA WA is headquartered in Perth, Western Australia, and services doctors and other medical professionals throughout Australia.

AMA WA holds data and information within computerised servers located at physical premises in Western Australia (the Servers) and virtual machines operating on the Servers. The Servers store high volumes of information created or collected by the plaintiffs relating to their members, their current and former employees, and their stakeholders, and information created by the plaintiffs relating to the plaintiffs themselves, including:

On 26 October 2025, unnamed persons claiming to be part of a named group gained unauthorised access to the Servers and deployed ransomware – a type of malicious software that encrypts systems until a ransom is paid. In the course of investigating this activity, AMA WA discovered a ransom note which claimed that AMA WA’s network had been encrypted, that the unnamed persons had downloaded compromising and sensitive data from the network (including information of the kind referred to at [6] above), and that the data would be published if AMA WA refused to communicate or failed to come to an agreement with the unnamed persons. The ransom note included instructions for AMA WA to communicate with the unnamed persons only through a specified chatroom. In these reasons, the unnamed persons are referred to collectively as the Threat Actor.

The Threat Actor posted a message in the chatroom demanding payment of a specified sum in return for the Threat Actor providing decryption tools and a complete list of all files they had taken from AMA WA’s network, promising that it would not attack AMA WA again in the future, and guaranteeing that “we will forget about this incident”.

AMA WA has not paid the ransom demanded by the Threat Actor. Nor has it paid any other sum to the Threat Actor.

AMA WA’s investigations have ascertained that the Threat Actor did exfiltrate large amounts of data (the Exfiltrated Dataset). Due to the number of files encrypted and the plaintiffs’ ongoing restoration efforts, it is not possible to enumerate all of the specific files comprising the Exfiltrated Dataset. However, having regard to the nature and volume of the data stored on the Servers (as referred to at [6] above) and the nature of the data that the Threat Actor claimed to have exfiltrated in the ransom note referred to at [7] above, it is probable that the Exfiltrated Dataset includes a significant quantity of information of the kind referred to at [6] above.

The Exfiltrated Dataset is a subset of the data stored on the Servers which the Threat Actor accessed without authority (the Impacted Dataset).

AMA WA notified its employees of the incident on 27 October 2025.

AMA WA notified the Australian Signals Directorate of the incident on 31 October 2025.

AMA WA takes precautions to prevent unauthorised access to and use of its data and information on the Servers by employing physical barriers to the Servers and technical barriers to the Servers and the data stored on them. AMA WA has never published the Exfiltrated Dataset itself.

AMA WA wishes to take all reasonable steps within its power to protect its legal interests (bearing in mind that it has contractual and fiduciary obligations of confidence in respect of some of the data likely to be included in the Exfiltrated Dataset), its commercial and reputational interests, and the interests of its stakeholders, members, employees and customers which would be likely to be adversely affected by dissemination of the Exfiltrated Dataset.

The identity of the Threat Actor is not known and its precise location cannot be ascertained. The application for default judgment proceeded on the assumption that the Threat Actor is located outside Australia. The evidence adduced by AMA WA supports that inference.

The plaintiffs commenced these proceedings on an urgent basis on 10 November 2025 against the defendant “Persons Unknown”, described as any person or entity which:

The Court made interim orders on an ex parte basis on that date:

Those orders were varied on 11 November 2025 to include certain defined terms that had accidentally been omitted from the terms of the orders made on 10 November 2025.

On 13 November 2025, the restraining orders were extended until further order.

The orders made on 10 November 2025 also included orders for substituted service on the defendants by sending a message to the chatroom specified by the Threat Actor containing a Dropbox link through which copies of the statement of claim and other documents can be downloaded. [1] The plaintiffs were granted leave to redact from the copies of the documents served all references to the names, identifying details, and contact details of the plaintiffs’ legal representatives, information technology and cyber-security experts, and certain other material. Interim non-publication orders were made pursuant to s 7(b) of the Court Suppression and Non-Publication Orders Act 2010 (NSW). Time for service was abridged to 4:00pm on 11 November 2025.

At the time of the hearing of the application for default judgment, the Threat Actor has not published the Exfiltrated Dataset online insofar as the searches and investigations made by the plaintiff’s expert had been able to ascertain. However, having regard to the ransom note, there remains a material risk that the Threat Actor will publish or otherwise disseminate the Exfiltrated Dataset.

The applicable legal principles are well established. Much of what follows draws on my judgments in Ansell Ltd v Persons Unknown [2] and ReadyTech Holdings Ltd v Persons Unknown, [3] in which I identified the principles by reference to earlier judgments of this Court. I have been greatly assisted by the detailed submissions made by counsel for the plaintiffs in relation to the application of those principles in the circumstances of this case.

The plaintiffs have adduced evidence that, on 11 November 2025, the Threat Actor was served in accordance with the substituted service orders made on 10 November 2025 [4] with: a Form 161 notice; the plaintiffs’ statement of claim and notice of motion filed on 10 November 2025; the affidavits relied on by the plaintiffs in support of the interim relief claimed in the notice of motion and the exhibits to those affidavits; and the written submissions made by counsel for the plaintiffs at the hearing on 10 November 2025 together with the orders made by the Court on that date, redacted as permitted by the Court’s orders.

Rule 11.8AA of the UCPR is engaged because the defendants, or at least some of them, are most likely located outside Australia and so have been served outside Australia. No appearance has been entered on behalf of any person or persons identifying themselves as a defendant in these proceedings. The time for doing so expired 42 days after service on 11 November 2025, being 23 December 2025. [5]

I respectfully agree with Brereton J’s conclusion in University of Notre Dame Australia v Persons Unknown (Notre Dame) [6] that, when considering an unopposed application under r 11.8AA, leave should be granted if:

I respectfully agree with and adopt his Honour’s reasons for that conclusion and his analysis of Agar v Hyde. [7]

In the present case, I am satisfied by the plaintiffs’ evidence referred to at [24] above that the Threat Actor has been served with the documents there referred to. As the plaintiffs submitted, neither the application for leave under r 11.8AA nor the application for default judgment was required to be served. [8]

I accept the plaintiffs’ submission that the relief claimed in the statement of claim includes an injunction to restrain the dissemination of the Exfiltrated Dataset at any location on the internet, which must necessarily encompass dissemination in Australia. That engages r 11.4 of the UCPR, which permits service of the statement of claim outside Australia without prior leave of the Court, because the case is of the kind referred to in paragraph (d)(i) of Schedule 6 to the UCPR. [9]

Neither the statement of claim nor the evidence that I have summarised at [4]-[22] above reveal any countervailing considerations that would cause the Court to decline to grant leave in this case.

No defence has been filed on behalf of any person or persons identifying themselves as a defendant in these proceedings. Irrespective of whether the defendants are permitted 28 days under r 14.3(1) or 42 days under r 11.8 of the UCPR to file a defence, the time for doing so has expired. [10] The defendants are therefore in default for the purpose of Part 16 of the UCPR. [11] The Court therefore has power to enter default judgment, including by granting injunctive relief. [12] Service having been established, the likelihood that the defendants are outside Australia is no obstacle to this Court granting such relief. [13]

The Court may give such judgment against the defendants in default as the plaintiffs appear to be entitled to on their statement of claim. [14]

As the plaintiffs submitted, an equitable duty of confidence arises when confidential information comes to the knowledge of a person in circumstances where they have notice that the information is confidential, so that it would be just in all the circumstances that they should be precluded from disclosing the information to others. In order to obtain an equitable remedy for a breach or apprehended breach of the duty, a plaintiff will typically need to identify the information specifically, and establish that it is of a confidential nature and that there has been actual or threatened unauthorised use of the information by the defendant to the detriment of the plaintiff. The requirement to identify the information specifically does not require a plaintiff to individually itemise documents in a case where the defendant has gained unauthorised access to a very large volume of the plaintiff’s confidential information. Such a requirement would be oppressive. The confidential quality of the information is generally demonstrated by the information not being public property and public knowledge, by the plaintiff having expended effort in the creation or collection of the information, and by the plaintiff having taken steps to protect the information and keep it largely to itself. In cases such as the present where a defendant has gained unauthorised access to, encrypted, and taken the plaintiff’s information to extort money from the plaintiff under threat that the information will otherwise be published, it can readily be concluded that the defendants obtained the information with knowledge that it was confidential. [15]

The plaintiffs’ pleaded case, which is supported by the affidavit evidence, is compelling, in my opinion.

The weight of authority favours the view that, in circumstances where the defendant has failed to file a defence to the statement of claim, the factual allegations pleaded in the statement of claim are taken to have been admitted. [16]

The plaintiffs’ statement of claim pleads facts the deemed admission of which provides ample support for findings that the plaintiffs’ information to which the Threat Actor gained unauthorised access was protected by the plaintiffs and included significant volumes of information of the kind referred to at [6] above which is confidential (including because the plaintiffs have developed effort in creating or collecting it, its secrecy is guarded by the plaintiffs, and it includes information of a private and personal nature concerning the plaintiffs’ members and employees), [17] that the Threat Actor was on notice that the information was confidential, and that its conduct in surreptitiously exfiltrating the information before making extortionate threats to publish the information make it just that the Threat Actor should be restrained from transmitting, publishing, or disclosing the information to others and should be restrained from using the information. The evidence summarised at [4]-[16] above provides further support for such findings. This is a case in which it would be oppressive to require the plaintiffs to individually itemise the confidential information, which has been described in sufficient detail in my opinion in the statement of claim and in the affidavits read by the plaintiffs. As there has been no transmission, publication or dissemination of the information to date, I accept the plaintiffs’ submission that the information retains its quality of confidence and warrants protection.

Injunctions in terms similar to those sought by the plaintiffs have been granted by way of default judgment in previous cases arising out of unauthorised access to and exfiltration of a plaintiff’s data, including confidential information, by persons who cannot be identified. [18] In the present case, the defendants have been defined in the statement of claim as persons unknown who have engaged in, or participated in or assisted with, specified past conduct, or who directly or indirectly made certain communications to the plaintiffs. The injunction sought will not operate against the world at large. In my view, the defendants are described with sufficient clarity to identify those included and excluded. [19]

Although the terms of the injunction sought mentions third parties, it is in the form discussed by Brereton J in Notre Dame, which I consider is appropriate for the same reasons as his Honour gave in that case. [20]

I accept the plaintiffs’ submission that the injunctions sought have utility, notwithstanding that there is a possibility that the Threat Actor may not obey the injunction. As Slattery J said in HWL Ebsworth, a reputation for wilful disobedience to the law does not confer immunity from injunctions. Moreover, as the plaintiffs submitted, it will be open to them to notify third parties of the injunction. [21] Such third parties, properly advised, would be aware that they should not take any step that would frustrate the effectiveness of this Court’s orders. [22]

Under s 7 of the Court Suppression and Non-Publication Orders Act (the Act), the Court has power to make non-publication orders on one or more of the grounds set out in s 8 of the Act.

AMA WA sought non-publication orders under the Act in the terms set out in paragraph 4 of Annexure A hereto. The information to which those non-publication orders apply falls into three broad categories:

Taking into account that a primary objective of the administration of justice is to safeguard the public interest in open justice, [23] I am satisfied that the evidence adduced by AMA WA demonstrates that the non-publication orders in the terms of paragraph 4 of Annexure A are necessary, in the strong sense in which that word is used in this context, [24] to prevent prejudice to the proper administration of justice [25] and/or to protect the safety of any person [26] and/or are necessary to serve the public interest in resisting the growing scourge of digital extortion crimes which significantly outweighs the public interest in open justice to the extent that open justice would otherwise inadvertently assist the Threat Actor or other potential threat actors. [27]

The evidence adduced by AMA WA establishes that there is a risk of the Threat Actor, or other potential threat actors, being inadvertently assisted by publication of the first and second categories of information referred to above, including by disclosing contact details for the Threat Actor to third parties who have no entitlement to the Exfiltrated Data but who may wish to acquire or access that data for their own benefit or gain. Indeed, those risks are rather obvious as a matter of common sense, having regard to the increasing incidence of digital extortion which is a matter of common knowledge and is illustrated by the judgments of this Court in previous proceedings arising out of such incidents. [28] It would be contrary to the public interest for the Threat Actor, other potential threat actors or third parties, to be inadvertently assisted in this way by the publication of the first and second categories of information. [29]

It would also be prejudicial to the administration of justice in these proceedings if the price of AMA WA adducing the evidence required to support its application for substantive relief was to directly or indirectly aid the Threat Actor, or other potential threat actors. The very harm that AMA WA seeks to prevent by commencing and prosecuting these proceedings would be likely to be exacerbated, and it would be likely to be exposed to an increased risk of further incidents of unauthorised access to and exfiltration of its confidential information. Looking to the broader concept of the administration of justice, such a price would be inherently likely to deter prospective future plaintiffs who are the victims of similar incidents from commencing proceedings of this kind in this Court. [30]

Non-publication of the first and second categories of information in this case does not preclude the Court giving reasons for judgment that are amenable to meaningful public scrutiny. Moreover, as counsel for AMA WA submitted, any person permitted to access the court file will be able to view the information that is the subject of order 4. The order only prohibits the publication of that information by disseminating or providing access to the information to the public or a section of the public by any means.

Insofar as they apply to the information in the first and second categories, the operation of the non-publication orders for a period of five years will impact on the open justice principle only to the extent that is, in my opinion, necessary to protect the public interest and to avoid prejudice to the administration of justice in this case and in the broader sense.

In relation to the third category of information referred to above, the evidence adduced by AMA WA establishes that its solicitors are a specialist legal and advisory firm that provides a range of services in relation to cyber, privacy and digital risk in Australia and New Zealand. In the relatively short period of time since the firm was established, it has frequently acted on multiple cyber incidents involving the same threat actor or group of threat actors. The firm receives instructions on a regular basis to make applications for injunctive relief of the kind sought in the present proceedings.

The evidence adduced by AMA WA also establishes that threat actors are prone to engaging in retaliation and pressure campaigns against individual lawyers, firms, and other individuals such as expert witnesses and expert consultants, who are named in documents filed in court proceedings of this kind as acting for or providing expert advice or assistance to or giving evidence for the plaintiff whose confidential data has been exfiltrated and who has been subjected to ransom demands. The evidence establishes that such campaigns may include sending threatening messages to named individuals, publishing or distributing information about named individuals in a way that may expose them to fraud attempts, phishing and other forms of cyber-attack, or attempting to track the movements and whereabouts of named individuals with a view to threatening their physical security.

An order for the non-publication of the names and identifying details of those individuals, without going so far as to suppress their identity, is a means of mitigating those risks to their personal safety, and I am satisfied that such orders are necessary for that purpose in this case. The impact of the order on the public interest in open justice is very slight, as it will have no bearing on the substance of the Court’s reasons for judgment and will not preclude the public from scrutinising the work of the Court in this case. It prevents prejudice to the public interest and to the broader administration of justice by mitigating serious personal risks that might otherwise deter experts from providing professional services to plaintiffs who are the victims of cyber-crimes, and that might otherwise deter individual legal practitioners and firms from accepting instructions to appear from plaintiffs in matters of this kind. The ability of parties to proceedings to obtain legal representation should they wish to do so, and the assistance that legal practitioners provide to the Court, is of central importance to the administration of justice in any proceeding.

I am satisfied that the three-year duration of the non-publication orders in relation to identifying details of solicitors and law firms and the six-month duration of the orders in relation to counsel is necessary to ameliorate the risks to their safety and to serve the public interest and prevent the prejudice to the administration of justice described above, having regard to the frequency with which the law firm acting for AMA WA acts in matters of this kind. In seeking only a six-month duration for the order insofar as it applies to identifying details of counsel, counsel accepted that they were in a slightly different position from the law firm. Amongst other things, the role of counsel does not extend to communicating directly with threat actors for the purpose of serving them with proceedings.

I am satisfied that the five-year duration of the non-publication orders in relation to identifying details of other named persons is necessary to ameliorate the risks to their safety, and to serve the public interest in plaintiffs being able to obtain such expert assistance as they may require in response to incidents of the kind that gave rise to the present proceedings, without the personal safety of those experts being placed at risk.

For all of the foregoing reasons, I made the orders set out in Annexure A to these reasons on 20 February 2026.