Looking Back on the Breach: Fundamentals of Preserving Privilege of Forensic Analyses in the Wake of a Data Breach

As we have written previously, preserving privilege of forensic analyses can be critically important in the aftermath of a data breach.  Questions of privilege and work-product protection routinely arise in post-breach litigation, especially concerning forensic investigation reports. Plaintiffs target these materials in discovery because they often provide a roadmap to the attack and include details regarding the victim business’s defenses and internal steps taken in response to a breach. Over the years, courts have grappled with these issues and reached varying results. In their recent article in the Cybersecurity Law Report, Alejandro Cruz and Elana Stern consider the case law to offer five analytical themes, as well practical guidance that may help maximize the protection afforded to post-breach forensic analyses in follow-on litigation.