Espire Infolabs v Sharma: High Court orders repayment after ex-employee's data breach threats

The High Court has granted summary judgement against a former IT project manager who threatened to expose the personal data of tens of thousands of private members' club users unless he was paid a six-figure sum, in a case that examines the enforceability of settlement agreements following data-related workplace disputes.

In Espire Infolabs Limited v Amit Mohan Sharma [2026] EWHC 2061 (Ch), His Honour Judge Jarman KC, sitting in the Business and Property Courts, ruled that the defendant had repeatedly and clearly breached the terms of a settlement agreement reached with his former employer, ordering repayment of the termination payment and continuing injunctive relief for a four-year cooling-off period.

Espire Infolabs, an IT services provider, employed Sharma in May 2025 on a six-month probationary basis and seconded him to a London private members' club, where he had access to personal data including addresses and payment card details belonging to around 55,000 members. When told in June 2025 that his secondment would end, Sharma informed the company he had copied members' data and would release it unless paid £150,000.

The parties subsequently entered a settlement agreement in July 2025, under which Espire agreed to pay Sharma a termination payment of £50,000, subject to tax deductions, in exchange for obligations including the deletion of confidential data, non-disclosure and non-contact provisions, and an agreement not to make derogatory statements about the company or its client.

Despite initial compliance, including confirmation that data had been deleted and verification by a forensic expert, Sharma disputed a tax deduction applied to part of the payment and began sending emails to the club, its members, the press and Espire's solicitors, threatening further disclosure of confidential information. In one message he sought a "seven figure settlement", warning he held data on 55,000 of the club's 208,000-plus members. He later contacted individual members directly, warning them their addresses had been "leaked", and emailed media organisations naming high-profile clients.

Following his arrest and the seizure of his devices in August 2025, matters temporarily subsided before resuming in October and November, with further demands for payment, including one seeking £310,000 to cover his "own savings" and a tax penalty, alongside threats to disclose information to competitors. Interim injunctions were granted in November 2025.

Sharma, representing himself, did not dispute signing the agreement or sending the messages relied upon by Espire, though he questioned the circumstances in which it was made and raised a counterclaim alleging harassment, negligence and abuse of process by the company and its solicitors.

The judge rejected these arguments, finding no real prospect that the defence or counterclaim could succeed at trial. He held that pre-agreement conduct was irrelevant to a settlement designed specifically to resolve prior disputes, and that Espire's efforts to secure compliance were a reasonable response to Sharma's own repeated breaches, not evidence of oppressive conduct.

The court granted summary judgement for repayment of the £50,000 termination payment, continued the injunctions for four years with liberty to apply for discharge, and gave permission for Espire to seek an assessment of damages. Amendments to the draft order included an exception permitting Sharma to seek future employment and a narrowed obligation to file a further affidavit addressing how customer and client data had been retained. The parties were directed to file an agreed minute of order, with submissions on any outstanding points, within fourteen days of hand down.