A US-based independent cybersecurity journalist has refused to comply with a UK court-ordered injunction to remove articles about a recent ransomware attack on UK private healthcare giant HCRG, citing First Amendment rights and sparking concerns about censorship and the limits of UK jurisdiction.

The journalist, operating under the pseudonym Dissent Doe, runs the website DataBreaches.net, which reported on the ransomware attack and the subsequent demands from the attackers. UK law firm Pinsent Masons, representing HCRG, obtained an injunction from the High Court of Justice in London, demanding that DataBreaches.net remove two articles about the attack, citing the need to prevent the publication or disclosure of confidential data stolen during the attack.

However, Dissent Doe declined to comply with the injunction, citing the fact that DataBreaches.net is not subject to the jurisdiction of the UK court and that the reporting is lawful under the First Amendment in the United States. The journalist also noted that the text of the court order does not specifically name DataBreaches.net nor reference the specific articles in question.

The move is seen as a rare instance of a journalist pushing back against legal threats and demands, which are often used to silence or intimidate cybersecurity reporters. The details of the injunction offer a unique insight into how UK law can be used to issue legal demands to remove published stories that are critical or embarrassing to companies.

HCRG, formerly known as Virgin Care, is one of the largest independent healthcare providers in the UK, with over 5,000 employees and covering half-a-million patients across the country. The company confirmed on February 20 that it was investigating a cybersecurity incident after the Medusa ransomware gang claimed responsibility for the breach, saying it had stolen two terabytes of data from the company's systems.

A spokesperson for HCRG said that the company took legal action aimed at preventing republication of any data accessed by the criminal group, to minimize potential risk to those who may have been affected. The company is investigating the incident with the support of external specialists and will notify anyone affected as necessary based on their investigation.

The incident highlights the challenges faced by cybersecurity journalists, who often walk a fine line between reporting on critical security issues and facing legal threats and demands from companies seeking to silence them. Dissent Doe's decision to push back against the injunction has sparked concerns about the potential implications for journalism and free speech, with the journalist warning that the court's injunction could open the door to widespread censorship of journalists in the UK or elsewhere.

"Journalists with any connection to the UK might be emailed injunctions demanding they remove past reporting on data stolen from UK entities, or they could be prohibited from any future reporting on any data stolen from a UK entity," said Dissent Doe.

The incident also raises questions about the limits of UK jurisdiction and the ability of UK courts to issue injunctions that affect journalists and publications based outside of the UK. As the cybersecurity landscape continues to evolve, the incident serves as a reminder of the importance of protecting journalistic freedom and the public's right to know about critical security issues.