The forensic report as a discovery target
Plaintiffs routinely ask for the incident investigation report and the work behind it. Whether it can be withheld as privileged or as material prepared for litigation depends largely on whether the work was directed by counsel to support legal advice or served ordinary business needs. Courts have ordered production where a report was widely circulated internally or used mainly to fix systems, even though counsel was nominally involved. Some companies commission separate workstreams for remediation and for legal advice to reduce that risk. No structure is immune from challenge, and the facts of how the work was actually used tend to decide it.
Records and witnesses beyond the report
Discovery in data breach litigation commonly reaches security policies, prior audits and penetration tests, vendor contracts, budget requests, ticketing systems, and messages among security staff. Information technology employees are often deposed, and their candid messages about known weaknesses can become central exhibits. Each side typically retains technical witnesses to explain what security measures were reasonable and what caused the intrusion, and those witnesses depend on the record the company preserved. Protective orders are usually negotiated so that sensitive security details stay out of public filings. Witnesses on both sides are tested at deposition on what they reviewed and what they assumed.
Planning for the long middle of the case
Litigation of this kind can last a long time, and costs tend to concentrate in discovery. Early decisions about custodians, search terms, and production formats go a long way toward setting that cost. Settlement discussions often run alongside discovery, sometimes with a mediator, and they are influenced by what the record is beginning to show. For companies already in a case, we review the discovery posture, the privilege position on investigation materials, and whether the defense strategy still fits the facts that have emerged. For a company not yet sued, the same review helps decide how to handle the investigation file now.
