“They took the client files. So I guess the privilege is gone too, right? Great.”

Not so fast.

It’s a natural first question after a firm gets hit. A thief taking privileged documents doesn’t automatically take the privilege with them.

Let’s take it apart. And a reminder: I’m a forensic examiner, not a lawyer. The final call on privilege is your attorney’s department, not mine.

Did the breach just waive my client’s privilege?

Generally, no. At least not by itself. Only previously privileged material gets that protection.

In Resolution Trust Corp. v. Dean, 813 F. Supp. 1426 (D. Ariz. 1993), an unauthorized leak of an internal legal memorandum did not waive attorney-client privilege. In Dukes v. Wal-Mart Stores, Inc., 2013 WL 1282892 (N.D. Cal. Mar. 26, 2013), unauthorized disclosures of an outside-counsel memo didn’t waive it either. These leak cases distinguish involuntary from voluntary disclosure.

Here’s the catch. Confidentiality precautions mattered. In Dukes, Wal-Mart’s own public comments waived privilege over disclosed content, although the court declined to extend that waiver to the entire memo.

Think of privilege as a fence around a field. A thief cutting through doesn’t make the field public land. Still, protect the fence: restrict access, assert privilege promptly, and object when someone tries to use the documents.

Jurisdiction and facts matter. Federal Rule of Evidence 502(b) addresses inadvertent disclosures in a federal proceeding or to a federal office or agency. Protection requires reasonable precautions and prompt, reasonable corrective steps. It isn’t a blanket safe harbor for stolen files.

Does privileged mean nobody can look at it?

Privilege is not a magic eraser for documents already on a leak site.

In Glencore International AG v. Commissioner of Taxation, [2019] HCA 26, Australia’s High Court held that privilege alone supplied no cause of action to recover stolen documents or restrain their use by tax authorities. That’s Australian law, not a U.S. rule. Winning the privilege argument and getting the genie back in the bottle are different fights.

What does the breached firm have to do?

ABA Formal Opinion 483 (2018) calls for reasonable efforts to detect breaches, stop them, mitigate harm, investigate, and restore services. Reasonable efforts, not perfection: a breach alone doesn’t establish an ethics violation.

The opinion requires notifying current clients when a breach involves, or has a substantial likelihood of involving, material client information. Significant disruption of representation can also require notice. It doesn’t impose the same Model Rules notice duty for former clients, but statutes and local rules may.

State notification laws and contractual deadlines need separate attention. Proof of stolen files isn’t always necessary before notice duties arise. Someone should watch the clock from day one.

Okay, what actually happened?

Now we’re in my neighborhood.

What left the building? Also ask what was accessed, altered, destroyed, or made unavailable. The evidence lives in fragile places: firewall logs, cloud audit logs, endpoint records, and the memory of running machines.

Wait too long, and the best evidence might just delete itself.

Contain the attack promptly. Preserve relevant logs, volatile data, and forensic images where feasible before wiping and rebuilding. Coordinate preservation with containment; don’t leave an attacker connected just to finish collecting evidence. (Did I have to say that?) Suspend relevant automatic deletion and document chain of custody. When litigation is reasonably anticipated, involve counsel in a preservation hold.

Will our forensic report be privileged?

Maybe. Don’t count on it.

In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), affirmed June 25, the forensic report lacked work-product protection because Capital One hadn’t shown it would not have been prepared in substantially similar form without anticipated litigation. Work product and attorney-client privilege are distinct protections.

In Wengui v. Clark Hill PLC (D.D.C. 2021), a law firm’s forensic report failed both tests. Routing the engagement through counsel wasn’t enough.

Have counsel structure the investigation around actual legal needs, distinguish that work from ordinary remediation, and limit distribution appropriately. Courts look at substance over letterhead.

Human nature doesn’t change, but the tools do. (If you read many of my other articles, I may be sounding like a broken record here. Or maybe a mantra) People have been stealing secrets for as long as there have been secrets. Today the burglar just doesn’t need to jiggle the lock on your file room.

Have a response plan that names names. Protecting privilege takes action, not just a label on the file.

Has your firm, or a client, been through one of these? Did the privilege hold up, and what do you wish you’d preserved sooner? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.