Due to the growing prevalence of data breaches and ransomware attacks, courts have been forced to interpret and nuance privilege in the context of post-breach forensic reports. One major consideration in the context of data breach litigation strategy is how to protect forensic reports prepared by outside forensic firms from discovery in civil litigation. If the forensic report is discoverable, it could be used by the opposing party and ultimately become part of the public record in litigation.
Companies and organizations generally want to maintain privilege over forensic reports because of the likely value to potential plaintiffs. In particular, forensic reports typically identify the likely method by which a threat actor accessed a company’s IT environment. In doing so, the report generally highlights critical vulnerabilities in its IT environment. Such information may identify areas in which a company failed to maintain industry standards, thereby potentially breaching its contractual and fiduciary obligations to protect sensitive information.
