Looking Back on the Breach: Fundamentals of Preserving Privilege of Forensic Analyses in the Wake of a Data Breach

The rise of ransomware and other increasingly sophisticated cyberattacks in recent years has made data breaches, large and small, a common and often existential threat to businesses across industries. Such events require both investigative and remedial steps, which include engaging forensic experts and attorneys to prepare for the litigation that has become an inevitable follow-on risk. Questions of privilege and work-product protection routinely arise in post-breach litigation, especially concerning forensic consultants' analyses. Plaintiffs target these materials in discovery because they often provide a roadmap to the attack and include details regarding the victim business's defenses and internal steps taken in response to a breach.

Since privilege and work-product protection issues began to surface in post-breach litigation, courts have grappled with them and reached varying results. Despite the uncertainty and highly fact-dependent analyses that have grown out of the case law, five themes emerge to inform best practices in mitigating the risk of compelled disclosure of work performed in the aftermath of a cyber incident. 

To continue reading Alejandro Cruz and Elana Stern's article in Cybersecurity Law Report article on this topic, please click here.