One of the common first steps that any business takes in the aftermath of a cyber incident is to commission a data breach incident report from an outside provider. The findings contained within those write-ups can often provide companies with a road map for correcting the offending weaknesses in their system. But a recent order from a judge in the U.S. District Court for the District of Columbia reinforces the notion that forensic reports can become a legal liability as well.

The ongoing case of Guo Wengui v. Clark Hill found plaintiff Guo Wengui moving to compel the law firm to produce “all reports of its forensic investigation into the cyberattack” that led to his personal information being disseminated. While the Clark Hill argued that the report was protected by attorney-client privilege, U.S. District Judge James Boasberg ordered for the document to be turned over last month.