Legal Action against unauthosrised access to a website
Discussion
Someone has gained unauthorised access to the admin on one of my sites and has downloaded revenues, stock lists and viewed customer data.
I have their IP address and their location and have recorded the logs of it happening, what pages they viewed, etc.
What recourse can I take in terms of legal action? Obviously security has been increased now but I can see this getting messy.....
I have their IP address and their location and have recorded the logs of it happening, what pages they viewed, etc.
What recourse can I take in terms of legal action? Obviously security has been increased now but I can see this getting messy.....
Edited by schueymcfee on Wednesday 12th March 14:51
Don't give details on here.
I would speak to a solicitor straight away. This is the type of thing which could ruin your business if they were to screw you over and contact all your client base...
Do it straight away and protect yourself and the solicitors will step up the right course of action for either civil or criminal proceedings.
I would speak to a solicitor straight away. This is the type of thing which could ruin your business if they were to screw you over and contact all your client base...
Do it straight away and protect yourself and the solicitors will step up the right course of action for either civil or criminal proceedings.
The first issue will be to link the IP address to someone in the "real world", so that you know who your potential claim is against. I'm sure the techies will be able to advise just how readily you can do this but, unless and until you can show on the balance of probabilities that it is that particular person behind the information theft, you're going to have an uphill struggle in a courtroom.
Once you know who you're dealing with, I think you can adopt a twin criminal and civil approach. Report it to the Police and tell them you want it investigated. In tandem, you can instruct solicitors to contact the person in question and require them to provide undertakings to return any material removed in fairly short order (2-3 days max) failing which you will issue an application for an injunction.
If it's serious enough, you may even want to look at jumping straight to issuing the application for injunctive relief on what is called a "without notice" basis i.e. without giving notice to the other side, so that they don't get wind of what you're doing until they're served with the order.
You need to seek legal advice sooner rather than later, if the data that has been removed is sufficiently important to your business.
Once you know who you're dealing with, I think you can adopt a twin criminal and civil approach. Report it to the Police and tell them you want it investigated. In tandem, you can instruct solicitors to contact the person in question and require them to provide undertakings to return any material removed in fairly short order (2-3 days max) failing which you will issue an application for an injunction.
If it's serious enough, you may even want to look at jumping straight to issuing the application for injunctive relief on what is called a "without notice" basis i.e. without giving notice to the other side, so that they don't get wind of what you're doing until they're served with the order.
You need to seek legal advice sooner rather than later, if the data that has been removed is sufficiently important to your business.
If the little scum bag had the skill to hack your admin area, they would have almost certainly used an annon proxy server to hide their real details. If you PM me the IP address I can run a quick check for you to see if it is a legit IP address or not.
Edited by jamesuk28 on Wednesday 12th March 16:32
Lurking Lawyer said:
The first issue will be to link the IP address to someone in the "real world", so that you know who your potential claim is against. I'm sure the techies will be able to advise just how readily you can do this but, unless and until you can show on the balance of probabilities that it is that particular person behind the information theft, you're going to have an uphill struggle in a courtroom.
This will require the police to request the ISPs radius logs to see which subscriber was assigned that IP at that time, the ISPs will typically only provide this with a warrant (which means finding a copper who understands the issue, and is prepared to put their time in to it!)Then you can trace it back to an address and bill payer..
The hard part is proving it was them (and not their dog / mate / neighbor on wifi / trojan / virus) that actioned the crime!
Thats the killer typically.
Very possible with large resources (ie good lawyer) but for the regular joe... its just not.
JamieBeeston said:
Lurking Lawyer said:
The first issue will be to link the IP address to someone in the "real world", so that you know who your potential claim is against. I'm sure the techies will be able to advise just how readily you can do this but, unless and until you can show on the balance of probabilities that it is that particular person behind the information theft, you're going to have an uphill struggle in a courtroom.
This will require the police to request the ISPs radius logs to see which subscriber was assigned that IP at that time, the ISPs will typically only provide this with a warrant (which means finding a copper who understands the issue, and is prepared to put their time in to it!)Then you can trace it back to an address and bill payer..
The hard part is proving it was them (and not their dog / mate / neighbor on wifi / trojan / virus) that actioned the crime!
Thats the killer typically.
Very possible with large resources (ie good lawyer) but for the regular joe... its just not.
jamesuk28 said:
JamieBeeston said:
Lurking Lawyer said:
The first issue will be to link the IP address to someone in the "real world", so that you know who your potential claim is against. I'm sure the techies will be able to advise just how readily you can do this but, unless and until you can show on the balance of probabilities that it is that particular person behind the information theft, you're going to have an uphill struggle in a courtroom.
This will require the police to request the ISPs radius logs to see which subscriber was assigned that IP at that time, the ISPs will typically only provide this with a warrant (which means finding a copper who understands the issue, and is prepared to put their time in to it!)Then you can trace it back to an address and bill payer..
The hard part is proving it was them (and not their dog / mate / neighbor on wifi / trojan / virus) that actioned the crime!
Thats the killer typically.
Very possible with large resources (ie good lawyer) but for the regular joe... its just not.
jamesuk28 said:
Jamie you obviously know a lot more about this kind of stuff than me, If the said "hacker" used an Anonymous ip address / proxy server, could they still be traced?
Anyone can be traced is the will is there assuming everyone is logging..If they use an Anony proxy, that would still have logs which would tie the request for the page to an IP address, you could then trace that IP address to a DSL provider (or another anony proxy) and so on... eventually you would get back to the culprit..
That assumes that EVERY site in the link Logs, and crucially, is willing to assist you.. alot of these Anony proxy sites specifically WILL NOT assist law enforcement (this is how they make their money from subscribers.. like the Swiss banks!) and they are off-shore in some no-law despot country which wont help..
Even then.. assuming you DO get help from everyone... they might be on free wifi in Mcdonalds in Russia... how are you going to trace them then?
Ultimately, unless they were stupid, or unless you're MI6... it's nigh on impossible to get any justice from the little sh!ts... and they know this.. which is why Security is paramount.
J
schueymcfee said:
I know who they are based on their fixed IP (a former employer) and also other information showing that a staff member was actioned to do it...
Then you're in a much stronger position.. but you need to ask yourself if you're prepared to spend the money on pursuing this..You'll be looking at £x0k to get this to the end, with solicitors fees, barristers fees, PI fees etc.
GL
J
JamieBeeston said:
schueymcfee said:
I know who they are based on their fixed IP (a former employer) and also other information showing that a staff member was actioned to do it...
Then you're in a much stronger position.. but you need to ask yourself if you're prepared to spend the money on pursuing this..You'll be looking at £x0k to get this to the end, with solicitors fees, barristers fees, PI fees etc.
GL
J
There is a middle ground though. That is the guy getting couriered papers to him basically saying 'We know what you are doing..." from a solicitor with whatever injunctive or 'over a barrel' type demands with regard to releasing and stopping him using the information.
At best he complies, at worst, he wont be trying it again!
JamieBeeston said:
schueymcfee said:
I know who they are based on their fixed IP (a former employer) and also other information showing that a staff member was actioned to do it...
Then you're in a much stronger position.. but you need to ask yourself if you're prepared to spend the money on pursuing this..You'll be looking at £x0k to get this to the end, with solicitors fees, barristers fees, PI fees etc.
GL
J
Gassing Station | Business | Top of Page | What's New | My Stuff