District Court Rejects Privilege Claim for Post-Data Breach Forensic Report

In Guo Wengui v. Clark Hill, PLC, the U.S. District Court for the District of Columbia granted the plaintiff's motion to compel production of the defendant's third-party forensic investigation report following a cybersecurity incident. The court held that the forensic report was not covered by the attorney-client privilege or the work product doctrine. Rahul Mukhi, Alexis Collins, Jonathan S. Kolodner, and Claire Santiago, of Cleary Gottlieb Steen & Hamilton LLP, discuss the ruling, which provides a cautionary tale for companies conducting post-breach investigations.