In June 2020 a Virginia federal court upheld an order for Capital One to hand over a Mandiant forensic report on its 2019 breach, rejecting a work product claim even though outside counsel engaged the firm. How you set up and use a report decides whether it can be protected. This is not legal advice.
What happened
According to a Sullivan and Cromwell client memo, Capital One identified unauthorised access on July 19, 2019. Outside counsel was retained the next day, and counsel engaged Mandiant on July 24. The engagement letter said services would be performed at counsel's direction and deliverables would go to counsel. It also incorporated terms from a pre-existing master services agreement and statement of work.
After the breach was announced, consumer plaintiffs sued and the cases were consolidated in the Eastern District of Virginia. Plaintiffs moved to compel the report. A magistrate judge granted the motion on May 26, 2020, and the district court affirmed on June 25, 2020.
Why the claim failed
The memo describes a test asking whether the document would have been created in essentially the same form without the prospect of litigation. The court found Capital One had not shown that. Points it relied on, per the memo:
- The pre-existing statement of work already called for the same services, and the court called the claim that the scope changed for litigation "hollow" given the identical scope.
- The costs were first paid from a fund for "business critical" expenses and later reclassified as legal.
- The report was shared with the legal department, the board, regulators, the external auditor and roughly 50 non-legal employees. The court treated that distribution as probative of why the report was produced.
The court also noted alternatives, such as different vendors, scopes of work or investigation teams.
What this does not say
It does not say reports can never be protected. Other courts have gone different ways, and the memo itself describes a series of cases. It is also one decision applying one circuit's test. Outcomes depend on facts and jurisdiction.
Practical questions to raise with counsel
- Do we have a separate engagement for the legal investigation, with its own scope, rather than reusing a retainer written for business needs?
- Who needs the report? A narrow distribution list is easier to defend than a wide one.
- Do we separate the privileged analysis from the operational remediation notes that engineers need to act on?
- How are costs recorded?
What engineers should do
Do not decide privilege yourself, and do not forward the report to a wide group out of habit. Ask counsel how to share findings. Keep working notes factual. Do not speculate about fault in chat threads.
Prepare this before an incident. The time to ask these questions is at the retainer stage, not during the first night of response. See also our log retention note.
Quick check
Did the court say Capital One broke the law?
No. The ruling was about whether a report had to be produced in civil discovery, not about liability.
Does counsel hiring the forensic firm guarantee protection?
No. The court looked at the pre-existing agreement, how costs were booked and who received the report.
Sources
Last reviewed: 19 October 2026.
