Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms

A template cannot make a business report into a privileged one. Judges have read these engagement letters in camera, compared them to the earlier vendor contract, looked at the invoices, and asked who got the report. Use the forms below to document a structure that actually exists.

How to use this toolkit

Each paper states its purpose, its owner, and its timing, then gives the text, then drafting notes with authority. Text in [BRACKETED CAPITALS] is yours to fill in. The defense papers are 1 through 7, 10, and 11. The plaintiff papers are 8, 9, and 12 through 14, though each side should read the other's, if only to see what's coming. Tool 15, the term sheet, is for both.

The law is in Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege, the sequence is in Defending or Bringing a Data Breach Class Action: A Practical Guide, and the task list is the Data Breach Litigation Readiness Checklist. For notification letters and incident logs, use the Data Breach and Incident Response Toolkit.

Table of contents

1. Outside-counsel-led forensic engagement letter
2. Dual-track investigation protocol
3. Report distribution log and briefing script
4. Litigation hold for technical evidence
5. Work product declaration (shell)
6. Complaint analysis worksheet
7. Forum and standing map
8. Plaintiff intake script
9. CCPA pre-suit notice
10. Standing motion outline
11. Implied contract defense chart
12. Standing opposition outline
13. Consolidated complaint standing allegations checklist
14. Forensic report discovery requests
15. Settlement term sheet

Tool 1: Outside-counsel-led forensic engagement letter

Purpose: Retain a forensic firm to help counsel give legal advice and prepare for expected litigation, separate from the operational response. Owner: Outside litigation counsel. Timing: After the incident is confirmed and counsel has documented why litigation is expected. Do not reuse the operations vendor's paper.

[LAW FIRM LETTERHEAD]
PRIVILEGED AND CONFIDENTIAL | ATTORNEY WORK PRODUCT

[DATE]

[COUNSEL-TRACK FIRM]
Re: Engagement to assist counsel, [CLIENT], Matter [NUMBER]

1. Why counsel is retaining you. [LAW FIRM] represents [CLIENT] in connection
with the security incident [CLIENT] confirmed on [DATE] (the "Incident"). Because
[CLIENT] has [received a demand / announced the Incident / will be notifying
approximately N persons], [CLIENT] reasonably expects litigation and regulatory
inquiry. We are retaining you so that we can give [CLIENT] legal advice about, and
prepare to defend, those matters.

2. What we are asking you to do. You will work at our direction on the following
questions that we identify as bearing on legal exposure:
   (a) [Specific legal question, e.g., how a plaintiff's expert is likely to
       characterize the security controls in place on DATE];
   (b) [Analysis of the operations team's factual findings for purposes of
       counsel's assessment of claims];
   (c) [Other tasks counsel specifies in writing].

3. What this engagement does not include. [OPERATIONS VENDOR] and [CLIENT] IT
are separately responsible for containment, eradication, restoration, root cause
reporting to the business, card brand or regulator reporting, and security
recommendations. You will not provide remediation advice or recommendations to
[CLIENT]. If you become aware of an urgent ongoing threat, tell us immediately.

4. Reporting. You will report only to [NAMED ATTORNEYS]. You will not prepare a
written report unless we ask for one in writing. Any written product goes only to
us. You will not send drafts or findings to [CLIENT] personnel.

5. Access to client personnel. Your contact with [CLIENT] personnel will be
arranged through us for the purpose of gathering information counsel needs.

6. Team. Your team will not include anyone who has worked on [CLIENT] incident
response or security assessment work before this engagement. [Identify members.]

7. Fees. You will bill [LAW FIRM]. Invoices will describe work at a level consistent
with this letter. [CLIENT] will pay through its legal budget under matter [NUMBER].

8. Confidentiality and preservation. Keep all materials confidential, store them
separately from other client work, preserve evidence you collect, and notify us of
any subpoena or request.

9. Testimony. This is a consulting engagement. If counsel later asks any team
member to testify, we will address that in a separate writing.

[SIGNATURES: LAW FIRM; COUNSEL-TRACK FIRM; ACKNOWLEDGED: CLIENT GENERAL COUNSEL]

Drafting notes.

• Section 1, the litigation purpose. State facts, not labels. In re Rutter's Data Security Breach Litigation, No. 1:20-CV-382 (M.D. Pa. July 22, 2021), turned on a scope to "determine whether" a compromise had occurred. A court applying Fed. R. Civ. P. 26(b)(3) wants to see litigation expected when the work began.
• Section 3, the carve-out. This is the heart of the letter. In Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), pages of remediation recommendations weighed against both work product and privilege. Make sure someone else truly does the carved-out work, and that the work results in a document. The same opinion faulted the absence of any eSentire findings.
• Section 4, reporting. In re Experian Data Breach Litigation, 2017 WL 4325583 (C.D. Cal. May 18, 2017), protected a report given to counsel and withheld from the incident response team. Reporting orally first leaves less to compel, but it also leaves less to rely on later, so make the choice deliberately.
• Section 6, the team. A new vendor is the cleanest answer to In re Capital One Consumer Data Security Breach Litigation, 2020 WL 3470261 (E.D. Va. June 25, 2020), and In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019). If you must use the retained vendor, at least change the team and scope, and don't borrow its existing statement of work by reference, as the Capital One letter did.
• Section 7, money. Capital One first paid from a retainer and a Cyber budget and later re-designated the payments as legal expenses. The court recited this history. Start with the legal budget.
• A warning about the privilege label. Headers do not decide anything. In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017), noted that labeling was one of the few things that changed. The attorney-client theory depends on United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), and is weaker than work product, so don't rest on it.
• Regulated clients. Before signing, ask whether any regulator can demand "assessment and root cause reports." If so, the operations report must exist and satisfy that demand. Morrill v. Lakeview Loan Servicing, LLC, No. 1:22-cv-20955 (S.D. Fla. Mar. 27, 2025).

Tool 2: Dual-track investigation protocol

Purpose: Give everyone a one-page rule for which track does what. Owner: General counsel, with the CISO. Timing: First day of the incident, updated as needed; better yet, adopt it in the incident response plan.

Ground rules to circulate:

1. Write Track A documents as if a plaintiff's expert and a regulator will read them, because they may.
2. Nobody forwards anything from Track B. Questions go to [NAME].
3. Track A does not wait for Track B and takes no direction from it about findings.
4. If a regulator, auditor, insurer, card brand, or law enforcement agency asks for a report, call [NAME] first. They receive Track A material.
5. Facts aren't privileged. Do not refuse to tell a colleague a fact needed for the response because counsel also knows it.

Drafting notes.

• This table implements In re Target Corp. Customer Data Security Breach Litigation, 2015 WL 6777384 (D. Minn. Oct. 23, 2015), as Clark Hill and Premera describe it. Capital One treats a parallel investigation as only one factor and said a short internal report was not proof of what the vendor would otherwise have produced. So Track A must be a real investigation with a real written result.
• Rule 5 follows Upjohn Co. v. United States, 449 U.S. 383 (1981). In Clark Hill, an answer that the firm's understanding came solely through counsel undercut its position.
• On auditors, a distinction is useful. Disclosure to an independent auditor did not waive work product in United States v. Deloitte LLP, 610 F.3d 129 (D.C. Cir. 2010), but Capital One treated distribution to the auditor and others as evidence of the document's business purpose. Waiver and purpose are separate questions.
• For a small company, a single-track approach with a frank, factual report may be the rational choice. Two tracks cost more, and an unenforced protocol is worse than none.

Tool 3: Report distribution log and briefing script

Purpose: Prove limited circulation, and keep briefings from turning into distributions. Owner: In-house counsel. Timing: From the first Track B communication until the end of the case.

Script for counsel briefing the board or executives on Track B matters:

I am giving you legal advice so the board can fulfill its responsibilities with respect to anticipated litigation. This briefing is confidential and privileged. Please don't take notes beyond what the secretary records, and please don't forward or discuss it with others. The operations team's report, which you received separately, covers what happened and what's being fixed. I'll tell you my assessment of legal risk, and I'm not providing a copy of any consultant's work.

Minutes language:

Counsel provided legal advice to the board regarding anticipated litigation arising from the Incident. The board received the operations report dated [DATE] from the CISO.

Drafting notes. The Capital One report went to about 50 employees, a corporate governance email box, the board, four regulators, and the accountant. Clark Hill cited wider sharing with leadership, IT, and the FBI. Experian survived partly because the incident response team did not get the report. If a recipient is outside the privilege circle, ask whether a Track A document can do the job. Shared privileged material is an issue covered by the Attorney-Client Privilege and Work Product for Businesses article.

Tool 4: Litigation hold for technical evidence

Purpose: Preserve what is about to be lost. Owner: Outside counsel to draft, general counsel to issue, CISO to implement. Timing: Within hours of confirmation. Refresh when complaints arrive and at each new custodian.

PRIVILEGED AND CONFIDENTIAL | LEGAL HOLD | DO NOT FORWARD

To: [CISO, IT LEADS, HR, COMMS, LEGAL, VENDOR MANAGERS, EXECUTIVES]
From: [GENERAL COUNSEL]
Date: [DATE]

[CLIENT] is reasonably likely to face claims relating to the security incident
confirmed on [DATE]. You must preserve all relevant documents and data, including
the following, until Legal tells you in writing that the hold has ended:

TECHNICAL: Firewall, VPN, DNS, proxy, EDR, SIEM, identity provider, email gateway,
cloud audit, and database logs for [DATE RANGE]. Disk and memory images of
affected systems. Malware samples and indicators. Backups in existence on [DATE].
Ticketing records. Vulnerability scans and patch records. Penetration tests.

IMMEDIATE ACTIONS FOR IT: Suspend rotation and deletion for the above. Do not
reimage, rebuild, or decommission an affected system until it has been imaged and
the image has been logged. Record who did what and when on the attached log.

BUSINESS: Security budgets and requests. Audits and assessments. Board and
committee materials on security. Privacy policies, all versions. Vendor contracts.
Customer and employee data inventories. Notification drafts and call center scripts.
Communications about the incident, including chat, text, and personal devices.

DO NOT discuss the incident's cause or fault in email or chat. Direct questions to
[NAME]. Do not create new analyses unless Legal or the CISO asks you to.

VENDORS: [NAME] will send preservation requests to [VENDOR LIST].

Drafting notes. Fed. R. Civ. P. 37(e) addresses loss of electronically stored information that should have been preserved, with the harshest sanctions reserved for intent to deprive. Rotating logs are the classic problem, as is reimaging during recovery. Also send written requests to vendors holding your data. Chat retention settings are a frequent surprise, so check them. Don't tell employees to stop writing facts; tell them to keep to facts.

Tool 5: Work product declaration (shell)

Purpose: Carry the burden on a motion to compel. Owner: Outside counsel, with the declarant. Timing: Draft early while memories are fresh; finalize when the motion arrives.

DECLARATION OF [NAME]

1. I am [TITLE] at [ENTITY]. I have personal knowledge of these facts.

2. Timeline. On [DATE] [CLIENT] confirmed [FACT]. On [DATE] [EVENTS SHOWING
LITIGATION WAS EXPECTED: e.g., first demand letter, notice decision, regulator inquiry].

3. Business investigation. On [DATE], [OPERATIONS VENDOR] began work under [CONTRACT
DATED]. Its purpose was to [CONTAIN, RESTORE, IDENTIFY ROOT CAUSE]. It delivered a
written report dated [DATE] to [RECIPIENTS]. That report has been produced at [BATES].

4. Counsel's investigation. On [DATE], [LAW FIRM] retained [COUNSEL-TRACK FIRM] by
letter dated [DATE]. [COUNSEL-TRACK FIRM] had no prior engagement for [CLIENT]
[or: its prior work was (DESCRIBE) and was performed by different personnel].

5. Difference. [COUNSEL-TRACK FIRM]'s work differed from [OPERATIONS VENDOR]'s
work in the following specific ways: [LIST: questions, personnel, data reviewed].
[COUNSEL-TRACK FIRM] gave no remediation advice to [CLIENT]. [CLIENT] did not use
its work to [restore systems, satisfy regulators, inform auditors, etc.].

6. But-for. But for anticipated litigation, [CLIENT] would not have retained
[COUNSEL-TRACK FIRM], and [the document] would not have been prepared, because
[SPECIFIC REASON: e.g., the business report already met every operational need].

7. Distribution. [The document] was provided only to [NAMES]. It was not provided to
[IT, BOARD, REGULATORS, AUDITORS, LAW ENFORCEMENT]. See attached log.

8. Payment. [COUNSEL-TRACK FIRM] invoices were sent to [LAW FIRM] and paid from
[LEGAL BUDGET ACCOUNT] from the first invoice.

I declare under penalty of perjury under the laws of the United States that the
foregoing is true and correct. 28 U.S.C. § 1746. Executed on [DATE].

Drafting notes. Each paragraph answers an opinion. Paragraph 3 answers Clark Hill, whose declarant failed to swear that eSentire ran its own investigation. Paragraph 5 answers Capital One, where the company failed to show substantive differences. Paragraph 6 answers the "substantially similar form" test of United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998). Generic statements failed in Dominion Dental. Paragraph 7 answers Experian and Capital One. Do not sign any sentence that isn't true; if paragraph 5 can't be completed honestly, the report probably isn't protected, and the better course is to negotiate production under a protective order and a Rule 502(d) order. Be careful that the declaration and interrogatory answers match. Also be careful that the declarant isn't later contradicted, as in Rutter's, where the company's own executive testified that lawsuits were not being contemplated and that the work would have been done anyway.

Tool 6: Complaint analysis worksheet

Purpose: Convert a stack of complaints into decisions. Owner: Defense associate or paralegal. Timing: Within 24 hours of each new complaint. Plaintiffs' lawyers can use it to review competitors' pleadings.

Tool 7: Forum and standing map

Purpose: Choose positions before filing anything. Owner: Lead defense counsel; plaintiffs' counsel uses the same map in reverse. Timing: Before any removal, Panel motion, or standing motion.

Drafting notes. The Fifth and Tenth Circuit entries are left off since we did not find a controlling published data breach standing decision from either in our review; check for one before you rely on this map. Every removal decision should also account for 28 U.S.C. § 1447(c) and Polo v. Innoventions International, LLC, 833 F.3d 1193 (9th Cir. 2016). The map shows tendencies, not predictions, and district courts apply these cases unevenly. Update it often.

Tool 8: Plaintiff intake script

Purpose: Screen a client quickly and honestly. Owner: Intake attorney. Timing: First call; before any retainer.

Before we start: this call is confidential. I can't promise a result, and many of
these cases pay individuals modest amounts. I want to see whether you have a claim.

1. Please send me the letter you received. Do you have the envelope? What date?
2. What's your relationship with the company? When did it start and end?
3. What information did you give them? Did anyone give it for you, such as an employer?
4. Did you click "I agree" to anything, sign anything, or join a rewards program?
5. Have you noticed anything unusual since? Unfamiliar charges, new accounts, a tax
   filing problem, an unemployment claim, medical bills, a credit alert? Dates?
6. Has any service told you your information is on the dark web? Do you have a copy?
7. What have you done in response? How long did it take? Did it cost anything? Did
   you miss paid work?
8. Have you received other breach letters in the last few years? From whom?
9. Do you recall reading the company's privacy policy? When?
10. How do you normally protect your Social Security number, passwords, and documents?
11. Are you willing to produce documents, sit for a deposition, and act for the class?
12. Please keep everything: letters, alerts, receipts, and notes of your time. Don't
    post about this on social media.

Drafting notes. Questions 2 and 5 test traceability; two of three plaintiffs in Brinker failed because their visits fell outside the at-risk dates. Question 4 matters because of Marriott. Questions 6 and 7 decide standing in Holmes forums and support it in Webb forums. Question 9 addresses the reliance problem in Attias v. CareFirst, Inc., No. 15-cv-882 (D.D.C. Sept. 13, 2023). Question 10 supports the causal inference courts drew in Webb and Bohnak.

Tool 9: CCPA pre-suit notice

Purpose: Satisfy the 30-day requirement for statutory damages. Owner: Plaintiffs' counsel. Timing: Before filing a statutory damages claim, and at least 30 days before amending to add one.

[DATE]
VIA [CERTIFIED MAIL / OVERNIGHT COURIER]

[BUSINESS NAME], Attn: [GENERAL COUNSEL / REGISTERED AGENT]
[ADDRESS]

Re: Notice under California Civil Code section 1798.150(b)

We represent [CLIENT], a California resident, individually and on behalf of a
proposed class of California consumers. [BUSINESS] notified [CLIENT] on [DATE] that
[his/her] personal information was affected by the incident described in your letter.

This letter is written notice that [BUSINESS] has violated the duty to implement and
maintain reasonable security procedures and practices appropriate to the nature of
the information, in violation of California Civil Code sections 1798.81.5 and
1798.150(a). As a result, [CLIENT]'s nonencrypted and nonredacted personal
information, namely [NAME IN COMBINATION WITH: SOCIAL SECURITY NUMBER / DRIVER'S
LICENSE NUMBER / ACCOUNT NUMBER WITH ACCESS CODE / MEDICAL INFORMATION], was subject
to unauthorized access and exfiltration, theft, or disclosure.

If a cure is possible and [BUSINESS] actually cures the noticed violation within 30
days, and provides an express written statement that the violations have been cured
and that no further violations shall occur, please send that statement to me. Under
section 1798.150(b), the later implementation of reasonable security following a
breach does not constitute a cure with respect to that breach.

[CLIENT] intends to seek statutory damages individually and on a class-wide basis if
this is not resolved. Please preserve all relevant documents.

[SIGNATURE]

Drafting notes. Track the statutory words of § 1798.150, and match data elements to § 1798.81.5. In In re Young Consulting Data Breach Litigation, No. 1:24-cv-3938 (N.D. Ga. Sept. 15, 2026), a notice five days before filing cost the plaintiffs statutory damages. Actual-damages and injunctive claims don't need notice, so you may file those first and add statutory damages once 30 days pass. The dollar range is adjusted for inflation; check the California Privacy Protection Agency's current table. Note the exclusions: Young Consulting also limited the claim as to data governed by HIPAA and California's medical confidentiality act.

Tool 10: Standing motion outline

Purpose: Structure a Rule 12(b)(1) motion. Owner: Defense counsel. Timing: Against the consolidated complaint.

INTRODUCTION: [One paragraph. What happened to these plaintiffs specifically, stated
fairly. What is missing.]

BACKGROUND: Allegations only (facial). Attach the notice letter if the complaint
incorporates it. List each plaintiff in a chart: data, misuse, money, time.

STANDARD: Fed. R. Civ. P. 12(b)(1); burden on plaintiffs; named plaintiffs must have
standing personally; standing for each claim and each form of relief; dismissal
without prejudice.

ARGUMENT
I. Plaintiffs do not allege a concrete injury for damages.
   A. TransUnion: risk alone does not support damages.
   B. Mere possession by a hacker is not public disclosure [Holmes forums]; or, no
      publicity allegations as to [PLAINTIFFS].
   C. "Information and belief" about the dark web does not suffice [Drivestream].
   D. Lost value and overpayment are not concrete [Healthcare Interactive;
      Remijas; Dieffenbach].
II. Future harm is not imminent.
   A. Clapper and Murthy: substantial risk; independent third parties.
   B. Apply the factors: targeting, misuse, sensitivity. [Be accurate.]
   C. Attenuated chain specific to these data types and dates.
III. Mitigation time and distress cannot substitute for imminent harm.
   A. Clapper: no manufactured standing. B. Holmes; Tsao; McMorris.
IV. Spam and other incidents are not fairly traceable. [Holmes n.3; Drivestream.]
V. Plaintiffs lack standing for injunctive and declaratory relief.
   A. An injunction cannot retrieve data [Webb]. B. No imminent second breach [Lyons;
      Holmes; Gulshan; Union Home].
VI. [IF APPLICABLE] Named plaintiffs [X] cannot trace injury: dates, other breaches.
CONCLUSION: Dismiss without prejudice for lack of jurisdiction.

Drafting notes.

• The controlling authorities are Clapper v. Amnesty International USA, 568 U.S. 398 (2013); Spokeo, Inc. v. Robins, 578 U.S. 330 (2016); TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Murthy v. Missouri, 603 U.S. 43 (2024); and City of Los Angeles v. Lyons, 461 U.S. 95 (1983). For supporting district court decisions, see In re Healthcare Interactive, Inc. Data Breach Litigation, No. SAG-25-4034 (D. Md. Aug. 27, 2026), and In re Gulshan Management Services Data Breach Litigation, No. H-26-200 (S.D. Tex. June 29, 2026).
• Adjust by forum. Section I.B is a Fourth Circuit argument. In the Second Circuit, Bohnak rejects it, and you should say so and preserve it in a sentence. Candor on adverse controlling authority is both an ethical duty and good tactics.
• Facial by default. A factual attack needs a narrow declaration. See In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874 (N.D. Ohio Sept. 28, 2026), and consider its treatment of evidence not tested in discovery. Never attach anything from Track B.
• If the case was removed, do not ask for dismissal without thinking it through. The remedy may be remand. General standing forms are in the Justiciability Toolkit.

Tool 11: Implied contract defense chart

Purpose: Evaluate the implied contract count element by element, using the actual documents. Owner: Defense associate. Timing: Rule 12(b)(6) briefing, and again at summary judgment.

Drafting notes. The state-specific rule governs every row. Implied contract is a place where the Rule 12 standard matters, and Georgia's state courts showed that in Bland. Remember Attias: thin evidence survived summary judgment, because a jury could infer a promise. Consider moving early on the consumer statute and unjust enrichment counts, and don't overpromise the client on this one. For unjust enrichment, pair the chart with Malvitz v. Fincantieri Marine Group, LLC, No. 24-cv-238 (D.D.C. June 12, 2025), and Alleruzzo v. SuperValu, Inc. (In re SuperValu), 925 F.3d 955 (8th Cir. 2019); on the other side, Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012).

Tool 12: Standing opposition outline

Purpose: Answer Tool 10. Owner: Plaintiffs' counsel. Timing: Opposition to Rule 12(b)(1).

I. Pleading stage: general factual allegations suffice; all inferences for plaintiffs.
   If a factual attack: request jurisdictional discovery; object to untested evidence.
II. Actual misuse. [Plaintiff X]: [fraud, posting]. One plaintiff's misuse informs risk.
III. Concrete injury: exposure of private information; close relationship, not an
   exact duplicate [Bohnak; Clemens]. Dark web listing [Holmes, even on its terms;
   Brinker; Young Consulting].
IV. Imminence: targeted attack, misuse, sensitivity [McMorris]. No long chain
   [Attias]. Hackers' purpose [Remijas].
V. Separate present harm: time as money [Webb; Dieffenbach]; out-of-pocket; distress
   [Clemens]. Reasonable because defendant told them to act [Galaria].
VI. Traceability: defendant need not be the most immediate cause [Attias].
VII. Injunction: specific ongoing retention and unfixed weaknesses, or measures that
   mitigate the harm of the first breach [Union Home].
VIII. Alternatively, leave to amend; if removed, remand under 28 U.S.C. section 1447(c).

Drafting notes. Ask for what you need. If the motion is factual, ask for targeted discovery on the fact raised. Union Home says such evidence should be closely scrutinized. In the Fourth Circuit, concentrate on who found what, where. Young Consulting is helpful where some named plaintiffs have alerts, since the court reasoned those alerts raised the risk for others. Be careful with the 33 percent discussion from Holmes; if you have data specific to this attacker or data type, plead it. Beck rejected a generic statistic.

Tool 13: Consolidated complaint standing allegations checklist

Purpose: Final review before filing. Owner: Lead plaintiffs' counsel. Timing: Before the consolidated complaint.

Tool 14: Forensic report discovery requests

Purpose: Build the record to compel. Owner: Plaintiffs' counsel. Timing: First set of requests, after any MDL conference, under Fed. R. Civ. P. 34.

REQUEST 1: All master services agreements, statements of work, retainers, letter
agreements, and amendments between You and any person providing incident response,
forensic, or security assessment services, in effect at any time from [DATE] to the
present.

REQUEST 2: All engagement letters relating to the Incident, including those among You,
counsel, and any vendor. [If privilege is claimed: identify under Rule 26(b)(5)(A).]

REQUEST 3: Invoices and payment records for each vendor in Request 1, including
general ledger codes, budget designations, and any re-designations.

REQUEST 4: All reports, findings, timelines, presentations, and summaries by any
vendor concerning the Incident, in draft and final form.

REQUEST 5: Documents sufficient to identify each person or entity that received any
item in Request 4, and the date received, including directors, auditors, insurers,
regulators, law enforcement, card brands, and business partners.

REQUEST 6: All communications with any regulator concerning the cause of the Incident,
including any request for a root cause report and Your response.

REQUEST 7: Documents showing changes to security controls recommended or made because
of the Incident. [Expect a Fed. R. Evid. 407 argument at trial; discoverability differs.]

INTERROGATORY 1: Describe each investigation of the Incident, including who conducted
it, the purpose, dates, and each resulting written product.

INTERROGATORY 2: State the factual basis of Your understanding of how the Incident
occurred, and identify the source of that understanding.

RULE 30(b)(6) TOPICS: (a) Retention and scope of each vendor; (b) purpose of each
investigation; (c) distribution of each vendor's findings; (d) when and why You first
anticipated litigation; (e) regulator communications about cause.

Drafting notes. Request 1 comes from Capital One, Premera, and Dominion Dental. Request 3 comes from Capital One. Request 5 reflects the Clark Hill discussion. Request 6 is Morrill. Interrogatory 2 is the one that hurt Clark Hill, and topic (d) is the one that hurt Rutter's. Defense counsel should prepare answers to these before they arrive and should expect Rule 37 practice. Use Rule 26(b)(3)(A)(ii) in the alternative if logs are gone, and the Nonparty Discovery Toolkit for subpoenas to vendors.

Tool 15: Settlement term sheet

Purpose: Frame a mediation. Owner: Lead counsel on both sides. Timing: Before or at mediation; final agreement to follow.

CONFIDENTIAL SETTLEMENT COMMUNICATION | FED. R. EVID. 408 | NON-BINDING
EXCEPT AS STATED

Case: [CAPTION]. Incident: [DATE, DESCRIPTION].

Settlement class: All persons [RESIDING IN THE UNITED STATES] who received notice of
the Incident [or: whose information was identified in the Incident]. Excluded:
[DEFENDANT'S OFFICERS, JUDGE, TIMELY OPT-OUTS]. [Subclass for California, if statutory
damages are valued separately.]

Fund or claims-made: [$ non-reversionary common fund / claims-made up to $ cap].
Residual: [PRO RATA REDISTRIBUTION / CY PRES: NAME]. No reversion to Defendant.

Benefits per class member:
 Tier 1 documented loss: up to $[AMOUNT] with reasonable documentation.
 Tier 2 lost time: up to [N] hours at $[RATE], on attestation.
 Tier 3 pro rata or flat payment: $[AMOUNT], no documentation.
 Tier 4 California statutory payment: $[AMOUNT] [if applicable].
 Credit monitoring and identity protection: [N] years, [PROVIDER], [FEATURES].

Security commitments for [N] years, at Defendant's cost and not paid from the fund:
 [SPECIFIC MEASURES: encryption of FIELDS, MFA on SYSTEMS, deletion of data older
 than N years, annual penetration test by independent firm, written program].
 Verification: [ANNUAL OFFICER CERTIFICATION TO CLASS COUNSEL]. Confidential.

Notice: [DIRECT EMAIL AND POSTAL, WEBSITE, TOLL-FREE NUMBER]. Administrator: [NAME].
CAFA notice: Defendant serves within 10 days of filing. 28 U.S.C. section 1715.

Service awards: Plaintiffs may seek up to $[AMOUNT] [if permitted in this circuit].

Attorneys' fees and costs: Negotiated only after the above. Plaintiffs will move for up
to [PERCENT] of the fund and costs up to $[AMOUNT]. Court's decision on fees does not
affect the settlement. Any reduction goes to class members.

Release: Claims arising from the Incident, as pleaded or that could have been pleaded
based on the same factual predicate. Excludes [EMPLOYMENT CLAIMS, UNRELATED INCIDENTS].

Confidential materials: Return or destruction under protective order. Producing any
document does not waive protection. [502(d) order.]

No admission. Fed. R. Evid. 408.

Conditions: Preliminary and final approval under Rule 23(e). Opt-out threshold:
[blow provision, letting Defendant withdraw above N opt-outs]. Insurer consent: [CONFIRMED].

Timing: Motion for preliminary approval within [N] days.

Drafting notes.

• Structure. Compare Colcord v. Premera Blue Cross (In re Premera), with up to $10,000 of documented loss, 20 hours of time at $20, and a floor reserved for class recovery, to the tiers in In re Wawa, Inc. Data Security Litigation, 141 F.4th 456 (3d Cir. 2025). In re Retina Group of Washington Data Security Incident Litigation, No. DKC 24-0004 (D. Md. July 21, 2025), and Rodriguez v. Professional Finance Co., No. 22-cv-01679 (D. Colo. Oct. 15, 2024), show smaller funds.
• Fees and reversion. The term sheet deliberately sequences fees last and bans reversion. In re Wawa, Inc. Data Security Litigation, 85 F.4th 712 (3d Cir. 2023). Huang v. Equifax Inc. (In re Equifax), 999 F.3d 1247 (11th Cir. 2021), affirmed a percentage of a large fund. Service awards are barred in the Eleventh Circuit under Johnson v. NPAS Solutions, LLC, 975 F.3d 1244 (11th Cir. 2020); confirm your circuit.
• Security terms. Objectors discount what the company already planned to spend, as with the pre-authorized $25 million in Wawa. Make the commitments specific and new where you can.
• Standing in settlement. A settlement class still needs Article III jurisdiction, and a court may ask. Be ready to explain standing under the circuit's rule, using the operative complaint.
• Rule 408 and privilege. Rule 408 covers use at trial, not discovery generally. Mark the document, and don't put admissions or Track B conclusions into it. Fed. R. Evid. 408. Valuation methods are covered in the Class Action Defense Toolkit. Approval timing is calendared with Rule 23(e) and 28 U.S.C. § 1715.

These forms are general starting points for lawyers and informed clients, and they are no substitute for advice on a particular incident.

Related Documents

Related Articles

• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the doctrine behind each form.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: corporate privilege.
• Rule 502 and Inadvertent Production: Waiver, Clawback Agreements, and Why Every Case Needs a 502(d) Order: waiver law.

Related Guides

• Defending or Bringing a Data Breach Class Action: A Practical Guide: the sequence in which to use these papers.
• Responding to a Data Breach: The First Seventy-Two Hours: the operational response.

Related Checklists

• Data Breach Litigation Readiness Checklist: A Practical Checklist: tasks to track.
• Federal Deadline Calendaring and Recovery Checklist: A Practical Checklist: removal and Rule 23(f) deadlines.

Related Toolkits

• Data Breach and Incident Response Toolkit: From Detection to Notification: notice and incident records.
• Clawback Toolkit: 502(d) Orders, Clawback Notices, and Privilege Review Protocols: the order to pair with any production.
• Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing: general standing forms.
• Class Action Defense Toolkit: From Complaint Through Settlement Approval: general class papers.
• Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege: vendor subpoenas.