LAW Partnership Secures High Court Win in Landmark Data Exfiltration Dispute

When a single privileged login can be used to move hundreds of gigabytes of confidential data off a company’s servers undetected, the fallout isn’t just a data breach, it’s a breach of trust with consequences that reach as far as the courtroom. LAW Partnership is pleased to announce a significant win before the High Court of Malaya at Kuala Lumpur, acting for our corporate clients in Malaysia’s energy and utilities sector, arising from an unauthorised exfiltration of confidential data, with a third-party subcontracting issue emerging as a critical turn in the case.

Brief Background

By way of a Letter of Award, our Clients (Plaintiffs) engaged a company (“2^nd Defendant”) to develop a system within its servers (the “Project“). For the purpose of the Project, the Plaintiffs created a remote access account (the “Account“) for an employee of the 2^nd Defendant (the “1^st Defendant”). The Account allowed the 1^st Defendant access to the Plaintiffs’ IT systems to carry out the Project work.

However, that access was abused and hundreds of gigabytes of the Plaintiffs’ confidential data was exfiltrated to an external cloud storage. These activities were captured by the Plaintiffs’ own cybersecurity system, which prompted the Plaintiffs to commence a deeper investigation.

The Turning Point: A Doorstep Delivery-Up Order (DDO)

With the evidence on the 1^st Defendant’s devices at real risk of destruction, the Plaintiffs moved quickly to secure a Doorstep Delivery-Up Order (“DDO”) which proved to be an important step in the proceedings.

The forensic extraction that followed uncovered further incriminating artefacts. However, the bigger revelation came during execution of the Order itself: the 2^nd Defendant admitted, on the spot, that it had engaged an undisclosed third-party vendor to help deliver the Project and shared the Plaintiffs’ proprietary information with that vendor throughout, without ever telling the Plaintiffs.

Without the DDO, this arrangement might never have come to light. It transformed the case from a single-employee data theft claim into a broader case of breach by the 2^nd Defendant.

The High Court’s Decision

The High Court found for the Plaintiffs, holding the Defendants liable for breach of confidence and unlawful interference with trade, and finding the 2^nd Defendant separately liable for breach of contract over the undisclosed subcontracting.

In his broad grounds of judgment, the learned Judicial Commissioner, YA Tuan Mohd Redzuan bin Idrus, held that:

• The presumption under Section 114A of the Evidence Act 1950 operated against the 1^st Defendant and was not displaced by him on the evidence;
• That conclusion was reinforced by a circumstantial chain of evidence including incriminating artefacts on the 1^st Defendant’s devices that he left unexplained; and
• The 2^nd Defendant’s actions amounted to fundamental breach going to the root of the contract, warranting the rescission of the contract between parties.

Key Takeaways

• Section 114A cuts both ways in cyber intrusion cases. The presumption of fact against a person in control of a computer from which unauthorised material is published or transmitted is a powerful evidential tool for plaintiffs but it is rebuttable, and the defendants’ failure to give a credible account of incriminating digital artefacts was decisive here.
• A Doorstep Delivery-Up Order can do more than preserving evidence, it can force disclosure. Fragile digital evidence disappears fast, and swift, well-executed preservation applications can surface facts a defendant never intended to reveal.
• Undisclosed subcontracting of confidential work can be a fundamental breach. Where a contract is premised on trust and confidentiality, quietly bringing in a third party without consent can go to the root of the bargain — not merely a technical slip.

 

This victory was led by Suaran Singh Sidhu and his team comprising Ashwinathan Selvanathan and Jaden Teo. This success reflects LAW Partnership’s strength in high-stakes disputes where commercial, technological, and evidential complexity converge.

---

Key Contacts

Please contact our team if you have any questions.

Suaran Singh Sidhu | Head, Dispute Resolution & Arbitration