Capital One kept a forensic firm on retainer, then engaged it through outside counsel after the breach. A court held the resulting report producible, because the services under both agreements were identical.

The notification review gets the attention and the specialist tools. The litigation that follows the notification is a different engagement, and it is where the breach response itself becomes the evidence.

The decision worth knowing

In the Capital One consumer data breach litigation, a federal district court in Virginia before Judge Anthony J. Trenga affirmed a magistrate judge’s order on 25 June requiring Capital One to produce its vendor’s post-breach forensic report to plaintiffs in a consumer class action.

Capital One had the forensic firm on retainer for cybersecurity matters, including potential incident responses, before the 2019 breach. After it, Capital One and outside counsel formally engaged the same firm to investigate and prepare a written report. The court described the services under the pre-breach agreement and the post-breach engagement letter as identical, and found the main difference was the role outside counsel would play.

The test Capital One had to meet was that the report would not have been prepared in substantially similar form but for the prospect of litigation. It did not meet it.

Two details that decided it

The report went to approximately 50 employees, the board of directors, and regulators. The court held that post-production disclosures are appropriately probative of the purposes for which the work product was initially produced. Distribution was evidence of purpose.

And when Capital One argued the order was unworkable, the court answered that the argument ignores the alternatives available to produce and protect work product — naming different vendors, different scopes of work and different investigation teams.

That sentence is the practical instruction. Structure, not labeling, is what protects the report.

What that means for the document work

If the forensic report, the engagement letters, the scoping correspondence and the distribution list are all potentially producible, then the breach response generates a discovery population of its own — on top of the underlying data about the affected individuals.

• Engagement and retainer documents, including anything predating the incident, because the comparison between them is the issue
• Scoping correspondence, which is where a changed purpose either shows or does not
• Distribution records for the report, which the court treated as probative
• Internal communications about the incident across legal, security, IT and communications functions
• Regulatory correspondence and notification filings across every jurisdiction notified
• The notification data set itself, and the decisions made about who got notified and why

The preservation problem is immediate

Breach response runs on ephemeral and informal channels. War rooms, bridge calls, chat threads spun up for the incident and abandoned, personal devices used because the corporate systems were compromised. Much of that is subject to short retention or no retention, and it is the record of what the company knew and when.

Preserving it in the first week costs almost nothing. Reconstructing it when the class action is filed eight months later is frequently impossible, and the absence is itself an argument.

Where we fit, and where we do not

We handle the litigation production: preservation across the response channels, collection, review for responsiveness to counsel’s protocol, privilege logging of what is withheld, and production. We do not do PII and PHI entity extraction for notification — that is a specialist tooling market and we will say so rather than pretend otherwise.

What we do is the part that starts when the lawsuits do.

What we do

Pro-Legal Services, Inc. supports post-breach class action document production from Arlington, Virginia — immediate preservation across incident response channels, collection of the response record including engagement and distribution documents, review to counsel’s protocol, and production with privilege logging.

Small business, minority-owned, SAM registered, prime or subcontractor.

Pro-Legal Services, Inc. supports breach litigation from Arlington, Virginia, for counsel in the District of Columbia, Maryland and Virginia and nationwide.

Incident this week, class action in eight months? Preservation across the response channels is the thing to do now. Call us before the war room gets torn down. Pro-Legal Services, Inc. · 1550 Wilson Blvd, Suite 250, Arlington, VA 22209 · 202-955-9400 · info@pro-legal.com