Legal Privilege In Cyber Incident Response: Insights From The LifeLabs Data Breach

When organizations fall victim to cyber-attacks or other incidents involving data security, they must respond in a way that allows for swift action, while still looking around corners to what additional risks might be lurking after the incident has been contained. Having details of the incident, internal systems or response disclosed externally could expose vulnerabilities that other cyber criminals might exploit. Additionally, confidential information about the incident response and what decisions were made during the course of managing it, including individual breach notifications, could be used in law suits against the organization.

Legal counsel is typically engaged to oversee cybersecurity incidents (sometimes referred to as "breach coaches"). There is an array of potential legal issues, including contractual and compliance-related, that require ongoing legal advice during the course of the incident response. Third-party forensic experts are often engaged by