Magistrate Judge Finds Data Breach Investigation Report Not Privileged

Last week, a magistrate judge in the Eastern District of Virginia held that a breach report prepared by Mandiant (a digital forensics investigator, among other things) in response to the Capital One data breach was not protected by the attorney work product doctrine. 

First some background:  In 2019, a hacker "gained unauthorized access" to Capital One's network.  According to the company, the event "affected approximately 100 million individuals in the United States."  Capital One says no credit card numbers or log-in credentials were compromised; less than one percent of those affected had their Social Security Numbers compromised; and the individual who took the data was caught by the FBI.