Service of court orders on cyber hackers by Qantas

July 21, 2025

Service of court orders are invariably necessary to permit action for contempt for a breach of those orders. In cases of injunctive relief commonly the Court requires service of those orders. It becomes more difficult when the subject of those orders inhabit the dark web, have no representatives to accept service of those orders and can easily disappear. Welcome to the world of service of cyber hackers.Non publication orders against cyber hackers are a relatively recent phenomenon as is the method of service.

Qantas served the non publication orders made by Justice Kunc of the New South Wales Supreme Court via Tox. According to affidavit material filed by Qantas the documents containing the orders were sent last Thursday and a return email was received 3 hours later. What is not clear is how the order has been brought to attention of those who may not be the cyber criminals but come upon this information.  That may be attended to by specific exemptions to the orders.  It is not known. In crafting orders it is important to make them sufficiently focused so as to avoid unwelcome consequences such as a victim of the cyber breach being in contempt because he or she found his or her information on the dark web or elsewhere.

The Australian has covered this story in How Qantas served papers on cyber criminals over hack attack on customer database. What seems to be clear is that cyber hackers are based outside Australia.  That is a perennial problem and one that does not Read the rest of this entry »

Qantas obtains interim injunction arising out of the data breach which affected 5.7 million customers

July 17, 2025

It is becoming common practice for companies affected by the significant data breaches to seek injunctive relief. The Australian reports in Qantas goes to court over cyber attack in attempt to stop stolen data being released or used. that Qantas has obtained an interim injunction in the New South Wales Supreme Court. A copy of the orders has not been released but it is reported as intending “..to prevent the data being accessed, viewed, released, used, transmitted or published by anyone including by any third parties.” There is no identified respondent to the application.  It is also covered by 9 News and Reuters.  If the process follows the approach taken by the court in the HWL Ebsworth application for injunctive relief in 2024.

Interestingly the National Office of Cyber Security prepared a report on the HWL Ebsworth Cyber Security Incident titled “Lessons Learned Review”.  Under the hearing “What was interesting” the report says the following about the injunction HWL Ebsworth obtained from the Supreme Court of New South Wales.  

The granting of an injunction from the Supreme Court of New South Wales to HWL Ebsworth was a key point of interest during the management of the incident. The injunction was sought by HWL Ebsworth to restrain further access to or publication of information exposed during the incident, in an attempt to protect client data, and minimise ‘online rubbernecking’. Overwhelmingly, government entities viewed this enabled better support to impacted clients (including individuals) through minimising the likelihood that other actors may access and act on the published data, and was overall viewed as a sensible step in the firm’s response.

HWL Ebsworth’s intention when seeking the injunction was never to stop its clients from accessing their own data, as several clients were granted exemptions to ensure access for this purpose could continue. However, the injunction also prevented accidental unauthorised access which would have been inevitable in the circumstances where clients of the firm were seeking their own information but would, in the process, further compromise the privacy of other matters unintentionally.

There is quite a bit of supposition in that assessment.  It is not possible to know whether the injunction performed that role.  There has been no reported contempt of court proceedings for breaching the injunction.  It would also be quite difficult to determine whether there was a reduction in ‘online rubbernecking’ to start with and whether it was reduced.  How to monitor on line rubber necking is another issue.  If the data is stored on the dark web in a particular site removing the data, highly improbable, would be a better solution than working out who viewed it, even more difficult.  That said injunctive relief is now part of the response in large scale data breaches.  

It is clear from the assessment that the orders were almost certainly more involved and complicated than a blanket prohibition.  There is reference to exemptions.  That is an important issue when seeking such orders.  It is important to avoid putting those who are victims who discover their personal information and in viewing it may in a position where they may be in contempt of court.  Clearly not an intended consequence.

The Australian story Read the rest of this entry »

X v Twitter Inc [2017] NSWSC 1300 (28 September 2017): equity, injunction regarding tweets, confidential information, Norwich Orders.

October 29, 2017

In X v Twitter Inc [2017] NSWSC 1300 the Supreme Court of New South Wales, per Pembroke J, issued a final injunction regarding a post on Twitter. In doing so the Court considered in detail the scope and operation of injunctions on Twitter, a platform with much of its operations located outside Australia.

FACTS

Between 16 and 19 May the first offending tweets appeared [6] with the author of the tweets used a twitter handle that falsely adopted the name of the plaintiff’s CEO.

On 19 May, the plaintiff’s solicitors wrote to Twitter Inc:

  • drawing attention to the tweets,
  • the offending information contained in them and
  • the user’s impersonation of the plaintiff’s CEO.
  • requesting Twitter Inc to:
    • remove the offending material from the Twitter website;
    • to deactivate the ‘fake’ user’s account;
    • to take all other steps available to it to prevent the user from publishing further confidential information on the Twitter website; and
    • to provide the identity and contact information of the user.

Twitter responded Read the rest of this entry »

Candy v Bauer Media Limited [2013] NSWSC 979 (20 July 2013): privacy, interlocutory application, injunctive relief, futility.

October 14, 2013

The Supreme Court considered an urgent application for an interlucotury injunction in a privacy related matter in Candy v Bauer Media Limited [2013] NSWSC 979. The urgent application was made on 20 July 2013 with the decision made and reasons published that same day.

FACTS

The plaintif, Holly Rachel Candy, is better known in Australia by her Maiden Name, Holly Valance.  Sometime Soapie star who later developed a musical, and occasional movie, career.  Now a celebrity in the UK married to a wealthy businessman.  For those consumers of gossip magazines and celebrity websites this is almost trite.  Nevertheless it is not knowledge that would be regarded as notorious and it does not seem to have made its way into the affidavit material with his Honour stating:

  1. The plaintiff is an actress. She is an Australian Read the rest of this entry »

Roberts v Investwell Pty Ltd (In liq) [2012] NSWCA 134 (25 May 2012): Winding up, payment to director when company insolvent, “Unfair preference”, ss 588FA, 588FC, 588FE, 588FF Corporations Act 2001

May 29, 2012

Last Friday, the New South Wales Court of Appeal in Roberts v Investwell Pty Ltd (In liq) [2012] NSWCA 134 considered the operation of equitable charges and mortgages in the context of unfair preferences.

FACTS

In June 2001 the Respondent (“Investwell”) purchased land in Marourabra to develop home units using its own funds, monies advanced from prospective purchasers and a loan from a credit union.  The Appellant (“Roberts”) was a director and shareholder of Investwell [3].  In April 2002 it became apparent that there was a shortfall in funding to complete the project. Roberts entered into an agreement whereby he agreed to use his best endeavours to provide further funds and security for the project [4].  On the sale of units the debt with the credit union was discharged leaving a balance of $164,306.83 which was paid to Roberts on the basis that he was a creditor ( not in issue) of the company in that amount.  It was not in issue that when the payment was made Investwell was insolvent  [6].

An order for the winding up of Investwell was made on 12 March 2007.  Investwell and the liquidator brought proceedings against Roberts claiming money he received was a voidable transaction [7].

The relevant provisions of the agreement are set out at  [9], the most relevant of which was Read the rest of this entry »

Business Structures Pty Ltd v D’Amico (t/a D’Amico Steel Works) [2012] VSC 146 (20 April 2012): Application to set aside statutory demand, demand claimed sums in excess of judgment the subject of the demand with no accompanying affidavit & Alda Constructions Pty Ltd v Car Parking Solutions Pty Ltd [2012] VSC 145 (20 April 2012):Application to set aside statutory demand pursuant to Section 459G,onus of establishing a genuine dispute.

April 23, 2012

Associate Justice Gardiner recently considered applications to set aside statutory demands in Business Structures Pty Ltd v D’Amico (t/a D’Amico Steel Works) [2012] VSC 146 and Alda Constructions Pty Ltd v Car Parking Solutions Pty Ltd [2012] VSC 145.

Business Structures Pty Ltd v D’Amico (t/a D’Amico Steel Works)

Facts

The sum in the demand comprised a judgment plus interest on the judgment.  The demand was not accompanied by an affidavit verifying it pursuant to section 459E(3) of the Corporations Act 2001.  A VCAT order, filed in the Magistrates’ Court pursuant to section 121 of the Victorian Civil and Administrative Tribunal Act 1998, is enforceable as a monetary order.  There was  no genuine dispute that the sum the subject of the demand is due and payable [5].

The demand claimed interest from the day after VCAT made the order until the day that the statutory demand was issued.

Decision

Had the demand been Read the rest of this entry »