Microsoft Corporation v Oxide Group Ltd [2026] EWHC 346 (Comm) (13 January 2026)

Neutral Citation Number: [2026] EWHC 346 (Comm) Case No: CL-2026-000007

IN THE HIGH COURT OF JUSTICE COMMERCIAL COURT (KBD) Rolls Buildings Fetter Lane London EC4A 1NL 13 january 2026 B e f o r e :

MRS JUSTICE DIAS ____

MICROSOFT CORPORATION Applicant - and -

OXIDE GROUP LIMITED Respondents ____ Digital Transcription by Epiq Europe Ltd, Lower Ground, 46 Chancery Lane, London WC2A 1JE Web: www.epiqglobal.com/en-gb/ Email: civil@epiqglobal.co.uk (Official Shorthand Writers to the Court) ____ MR J McWILLIAMS (instructed by Orrick Herrington & Sutcliffe LLP) appeared on behalf of the Applicant ____ HTML VERSION OF JUDGMENT (APPROVED) ____ Crown Copyright © MRS JUSTICE DIAS: This is an application for Norwich Pharmacal relief by Microsoft Corporation against an English company, Oxide Group Limited, to obtain disclosure of information and documents. This information and these documents are said to be needed so that Microsoft can be put in a position to take steps to protect its rights arising out of what is said to be industrial scale infringement of its copyright and trademark by operators of a website going by the name of RedVDS.com, which operates on a server leased from Oxide. The RedVDS operators have cloned unlicensed evaluation copies of Microsoft's Windows Server 22, which they have made available to multiple users who appear to be using them to conduct cybercrime and other illegitimate activities. Investigations by Microsoft suggest that some 6,000 copies of these unauthorised and unlicensed versions of Windows Server 22 are being made available each month at

substantial profit to RedVDS. Investigations by Microsoft have further revealed that Oxide has or is likely to have information which would enable the operators and users to be identified. It should be said that RedVDS does not appear to be a legal entity of any sort. The registration details which it gave to register its domain name relate to a demolished building and a fictitious individual. The evidence on which Microsoft relies is set out in some detail in the witness statements of Mr Rizzo and Mr Ensz and I do not repeat it. The application is made as a matter of urgency and without notice and the court was requested to sit in private. I am satisfied as required under CPR Part 39.2(3) that publicity in this case would defeat the object of the hearing and that it is therefore necessary for the court to sit in private in order to secure the proper administration of justice. As regards the urgency, the evidence shows that there are steps being taken by various law enforcement agencies which may alert the RedVDS operators and users to the fact that Microsoft is conducting investigations into them. Relief is therefore needed, if appropriate, sooner rather than later to avoid those operators and users being tipped off. More pertinently, proceedings have been commenced in New York to obtain various forms of relief. Those proceedings become public tomorrow through the posting of

what are called Splash notices. Once that occurs, the RedVDS operators and users will be alerted to the fact that they are being investigated and may well take evasive action by destroying or removing any evidence which might help identify them. It is therefore clearly necessary for this hearing to have taken place before those Splash notices make the investigation public. As regards the application being brought without notice, the concern is that Oxide might alert its customers, the RedVDS operators, to the fact that the application has been made or is being made. Again, if that happened, it would likely defeat the purpose of the application. The claimant is seeking a non-disclosure order, but of course that would only be effective once the court had actually made the order. Prior notice would still leave a window of time where the claimant would be exposed. A further aspect in this context is that it seems that Oxide is itself using an unlicensed evaluation copy of Windows Server 22 in breach of copyright. The possibility cannot therefore be excluded that prior notice would undermine the application. Most Norwich Pharmacal orders involve a third party, typically a bank, who has been innocently involved in some form of illicit activity. The usual course in that type of case is to alert the third party and obtain their consent, or at least their lack of objection to the terms

of the order sought, but I am satisfied that that is not a practical option in this case and that it is appropriate to proceed without notice. As regards the substantive relief sought, CPR Part 31.17 requires that: first, the claimant must demonstrate a good arguable case that it has been the victim of a legally recognised wrong; secondly, the respondent must have been mixed up in the commission of that wrong so as to have facilitated it in some way; thirdly, the respondent must be able or likely to be able to provide information or documents which are necessary to enable the ultimate wrongdoers to be identified and pursued; and fourthly, it must be an appropriate and proportionate order to make in the circumstances of the case. In my judgment, there is an overwhelming case here that all four requirements are satisfied. It is clear from the evidence before the court that the RedVDS operators and users are infringing Microsoft's copyright and trademark on an extensive scale. There is also evidence that at least some of the users are committing cybercrimes which are obviously illegal and need at the very least to be reported to the relevant authorities and investigated. There can be no doubt that Oxide has facilitated this wrongdoing because it is Oxide which has leased the server through which these illicit operations are being conducted. Microsoft accepts that Oxide may not be

aware of the actual uses to which the copies of Windows Server 22 are being put. In other words, Oxide may not itself be aware of the criminal activities and the cybercrimes being committed by operators and users, but knowledge is not necessary to justify Norwich Pharmacal relief. It is sufficient that the respondent is innocently mixed up in the wrongdoing. In this case, however, there is the further factor that Oxide itself appears to be using an unlicensed evaluation copy of Windows Server 22. Thirdly, I am satisfied on the evidence that Oxide has or is likely to have the information and documents which are sought by the order. Microsoft conducted various test buys from which it was able to determine the type of information which the operators and users would have had to provide to Oxide. I am also satisfied that Oxide may well have abuse reports generated as a result of complaints by members of the public, or various logs or support tickets which may have been generated as a result of the use of its server. In the circumstances, it is entirely appropriate and proportionate to grant the relief sought. The information and documents targeted are comparatively limited and focused and I am satisfied that the primary purpose of this application is to vindicate Microsoft's own rights and the infringement of Microsoft's copyright and trademark. Mr McWilliams, who appeared on behalf

of Microsoft, nonetheless points out that the order would also be of considerable collateral benefit to the public in assisting in the prevention of further cybercrime and the bringing of any criminals to justice. A further point which should be addressed in the context of the court's discretion relates to the proceedings in New York. As explained by Mr McWilliams, these have effectively run their course in the sense that Microsoft has obtained the relief that it was seeking and hoping to obtain in those proceedings. The present application is therefore not made for the purpose of furthering those proceedings or to gather evidence for them, but to identify any wrongdoers who may be making use specifically of the server provided by Oxide. If information comes to light as a result of this order which may potentially bear on the New York proceedings, the question of whether it can be used in those proceedings can be ventilated at that stage. But as Mr McWilliams points out, that would only be an incidental consequence of this application and not its primary purpose or indeed its purpose at all. For all these reasons, I am satisfied that it is appropriate in principle to grant the order. Microsoft further seeks an order against Oxide relating to the preservation of evidence. I accept that such an order can be made against a third party in the position of Oxide, even though Oxide

itself is not the target of the proposed proceedings that Microsoft may wish to bring having obtained the information. Since the information is to be provided in any event and Oxide would be in contempt of court if it attempted to destroy it, it seems to me that there can be no prejudice to Oxide in making a positive order for the preservation of that evidence. Indeed, it makes perfect sense to order that it be preserved where there is a lingering concern that Oxide might take steps, whether inadvertent or not, to remove or destroy it. Further, Microsoft seeks an order sealing the court file and providing that the application not be disclosed until after the posting of the Splash notices in the United States. In practical terms, they seek a non-disclosure order until 1 pm tomorrow. I am satisfied that this is an appropriate order to make for much the same reasons that I have accepted it was appropriate to proceed without notice. It seems to me that if the existence of this order were made public before then, it would risk defeating the purpose of the exercise. I was informed by Mr McWilliams that, inadvertently, the claim form when issued was not marked confidential and that Microsoft has in fact been contacted by a reporter. However, there is no evidence that Oxide itself has yet been alerted to this application and it is quite possible that it is still unaware that it has

been brought. It cannot therefore be said at this stage that a non-disclosure order would serve no useful purpose. I do, however, draw attention to the public domain documents pilot which came into force at the beginning of this year, of which the parties will need to be aware and they will need to prepare to deal with that as and when the proceedings do become public. BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII