Defending or Bringing a Data Breach Class Action: A Practical Guide

Picture two desks on the same Thursday morning. At the first, a general counsel has a printout of six complaints, all filed since the notice letter went out on Tuesday, and an email from the CISO asking whether she can forward the forensic firm's draft to the board. At the second, a plaintiffs' lawyer has a voicemail from a retired teacher who got the letter, plus a blank complaint template and a nagging awareness that three other firms have already filed.

Each of them is about to make decisions that will be hard to undo. The general counsel's answer about that draft may determine whether it becomes the lead exhibit at class certification. The lawyer's choice of courthouse may determine whether the teacher has a case at all. This guide takes those decisions in order. For the law behind them, read Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege. Getting the notification itself right is covered in Responding to a Data Breach: The First Seventy-Two Hours.

The short answer

If you are defending:

• Decide the investigation structure before the first vendor starts typing, and make it true rather than merely well papered.
• Read your notice letter as Exhibit A to a complaint, because it will be, and that cuts both ways.
• Map the forum before you remove. A Fourth Circuit court and a Second Circuit court will treat the same complaint very differently, and a removed case with no standing goes back to state court.
• Raise every contract defense, especially class waivers and arbitration clauses, in the first responsive paper.
• Move on standing plaintiff by plaintiff and remedy by remedy, and think hard before filing forensic evidence to support the motion.

If you are bringing the case:

• Screen on data type, targeting, and misuse before anything else. Then screen the client's own facts: dates, other breaches, and what they have actually spent.
• Choose the forum as carefully as you choose the theory. Look for a named plaintiff who has found data on the dark web or suffered real fraud.
• Send the California notice at least 30 days before seeking statutory damages under the CCPA.
• Ask early for the vendor contracts, invoices, and distribution lists. They win the forensic report motion.

Either way: most surviving cases settle, so build the record for the mediation from the start.

How a case usually unfolds

Wawa settled after a single mediation session about nine months into the case and then spent years on approval and fee appeals. The Marriott MDL, by contrast, took two trips to the Fourth Circuit on certification alone. Neither timeline is unusual.

Part One: The defense, from notice to dismissal

Step 1. Start the record the day you know (legal, security, within 24 hours)

Who: general counsel and outside counsel. What: preservation, insurer notice, and a decision-maker.

Issue the litigation hold as soon as a claim is reasonably foreseeable, which after a confirmed breach means immediately. The system-level trap is rotation. Firewall, VPN, identity provider, and endpoint logs often roll off within weeks or months, and the instinct to reimage compromised machines destroys memory and disk evidence. Fed. R. Civ. P. 37(e) governs loss of electronically stored information that should have been preserved. Ask IT to suspend rotation and to image before rebuilding, and write down what you did and when, since Rule 26(b)(3) won't protect underlying logs anyway.

Notify your cyber carrier under the policy's terms. Many policies have panel forensic vendors and panel counsel, which can collide with the structure you want; see Placing and Tendering a D&O or Cyber Claim. Ask the carrier in writing to approve a counsel-retained firm before anyone signs.

Step 2. Build the investigation so that the story is true (first 48 hours)

Every lost forensic report case has the same plot: one investigation, a lawyer's name added, and a report that served all purposes. Your job is to avoid that plot in fact, since Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), shows courts will read the report in camera and check the claim against the record.

Decision: one track or two? Here are the honest options.

The court in In re Capital One Consumer Data Security Breach Litigation, 2020 WL 3470261 (E.D. Va. June 25, 2020), pointed to the alternatives of different vendors, different scopes of work, or different investigation teams. Treat that as the menu.

The test to run on any structure. Ask: if no one ever sued, would this exact document exist in roughly this form? Ask who outside legal needs it. Ask who is paying. If the answers are "yes," "IT and the board," and "the security budget," you have a business document, and In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019), tells you a conclusory affidavit won't rescue it.

Sector check. If a regulator can demand root cause reports, assume it will. In Morrill v. Lakeview Loan Servicing, LLC, No. 1:22-cv-20955 (S.D. Fla. Mar. 27, 2025), the mortgage company's reports lost protection on reconsideration because they turned out to be what state regulators required. The fix is to prepare a separate compliance report and give regulators that one, under whatever confidentiality protection the governing statute offers. Check with regulatory counsel first, since an examiner may ask directly about other reports and you cannot mislead one.

Scope language. Avoid the Rutter's drafting. A stated purpose "to determine whether unauthorized activity" had compromised data invited the holding that nobody yet anticipated litigation. In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017), shows an amended statement of work that changes supervision and nothing else accomplishes little. A sample scope appears in the Data Breach Litigation Toolkit.

Discipline. The privileged track reports to outside counsel. Nothing goes to IT, the board, the auditor, or the FBI as a report. Counsel may give the board advice, and if the operations team needs a fact, the operations track finds it. Clark Hill's sharing with leadership, IT, and the FBI weighed against it. Capital One's roughly fifty employees and four regulators were devastating.

Step 3. Write the notice letter for three readers (before mailing)

Regulators, class counsel, and a judge deciding standing will read it. State law sets the required content. Beyond that, these opinions show how each phrase has been used.

• "We have no evidence of misuse." It must be true. If it is, it helps: in In re Drivestream, Inc. Data Breach Litigation, No. 1:26-cv-00713 (E.D. Va. Aug. 21, 2026), the court used that sentence against plaintiffs who attached the letter to their complaint. In Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023), a similar sentence did not stop a court from crediting a plaintiff's allegation of tax fraud.
• "We recommend you change passwords, freeze your credit, and monitor your accounts." You may be legally required to say some of this, and you should say it because it helps people. Know that courts have noticed. In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018), and Galaria v. Nationwide Mutual Insurance Co., 663 F. App'x 384 (6th Cir. 2016), both cite such advice in finding a real risk.
• Offering credit monitoring. Do it where warranted. Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), refused to treat the offer as a concession. Other courts have been less generous, as Beck acknowledges.
• Listing data types precisely. In Holmes v. Elephant Insurance Co., 156 F.4th 413 (4th Cir. 2025), and Drivestream, plaintiffs' spam injury failed for lack of traceability because phone numbers were not among the compromised data. An accurate list narrows the case. An overinclusive one, written to be safe, hands plaintiffs an injury.

Sample sentence, where accurate:

Our investigation is continuing. As of the date of this letter, we have identified the following types of information in the affected files: [LIST]. We are not aware of any misuse of this information. We are offering [N] months of credit monitoring at no cost, and we encourage you to review the enclosed steps you can take.

Then have one person confirm every factual statement against the operations track, not the privileged one, so that the letter's support is producible.

Step 4. Triage the complaints (days 1 to 10)

Assign an associate or paralegal to monitor dockets daily and keep a one-line chart: court, named plaintiff, state, data alleged, claims, forms of relief, fraud alleged or not, dark web alleged or not. A worksheet for this is in the toolkit. Do not rush a response. Most courts will stipulate to a schedule tied to a consolidated complaint, and there is rarely a reason to answer six pleadings that are about to be replaced.

Tender to vendors now if the breach was at a vendor, and to customers if you are the vendor. In re Young Consulting Data Breach Litigation, No. 1:24-cv-3938 (N.D. Ga. Sept. 15, 2026), and In re Salesforce Customers Security Incident Litigation, No. 25-cv-07232 (N.D. Cal. Sept. 14, 2026), show plaintiffs now sue both ends of that relationship. The contract's indemnity and notice clauses have deadlines of their own.

Step 5. Choose the forum deliberately (days 10 to 30)

Removal. A notice of removal is due within 30 days of service under 28 U.S.C. § 1446(b). The Class Action Fairness Act, 28 U.S.C. § 1332(d), requires 100 members, $5 million in controversy, and minimal diversity. Here is the tension: to remove, you assert federal jurisdiction. If you then argue that no plaintiff has standing, the likely remedy is remand under 28 U.S.C. § 1447(c). Polo v. Innoventions International, LLC, 833 F.3d 1193 (9th Cir. 2016). State court then proceeds without any Article III filter, possibly under a more forgiving pleading standard, as Bland v. Urology of Greater Atlanta, LLC, No. A25A1133 (Ga. Ct. App. Oct. 6, 2025), illustrates. So before removing, ask whether you actually prefer federal court on the merits, on class certification under Rule 23, and on appellate review, even if the standing argument ends up unavailable or self-defeating. Often the answer is yes. Removal mechanics are in Removing or Remanding a Class Action Under CAFA. Watch the deadline with care, since a missed removal window is hard to repair.

Centralization. If cases sit in several districts, any party may move the Panel under 28 U.S.C. § 1407. You may instead try to transfer everything to one district under § 1404 and consolidate under Rule 42, which avoids the Panel. In In re Sonic Corp. Customer Data Security Breach Litigation, 276 F. Supp. 3d 1382 (J.P.M.L. 2017), the defendant opposed centralization and lost. Fed. R. Civ. P. 16.1, in force since December 1, 2025, shapes the first conference in an MDL. Bring to that conference a view on leadership structure, early exchange of the factual bases for claims, and a plan for privilege logs. See Practicing in an MDL.

Contract defenses. Pull every set of terms that applies to any plaintiff: app terms, loyalty program terms, patient forms, employment agreements, vendor flow-downs. The lesson of Maldini v. Marriott International, Inc., 140 F.4th 123 (4th Cir. 2025), runs in two directions. A one-sentence class waiver undid years of class litigation, and Marriott kept it alive by raising it in its motion to dismiss, its answer, discovery, and its opposition to certification. Even so, it took two appeals, partly because the first district judge called the defense a one-line boilerplate. Raise it early, specifically, and repeatedly. Under Morgan v. Sundance, Inc., 596 U.S. 411 (2022), litigation conduct inconsistent with an arbitration clause can waive it without any showing of prejudice, so decide quickly whether to compel arbitration.

Step 6. Build the standing motion (months 2 to 6)

Facial or factual? A facial attack accepts the allegations and tests their sufficiency, which is what most defendants file. A factual attack brings evidence, and the court may look outside the pleadings. Kerns v. United States, 585 F.3d 187 (4th Cir. 2009), and In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874 (N.D. Ohio Sept. 28, 2026), explain the difference. In Union Home, the court accepted an expert's supplemental report but said untested evidence is "at best" persuasive, used it for the factual attack only, and still found standing, because nothing in the report rebutted the increase in spam. A factual attack has real costs: it invites jurisdictional discovery, and filing forensic conclusions invites the argument that you have put the investigation at issue. Use it only with a narrow, nonprivileged declaration on a discrete fact, such as a machine that held no relevant data or a dark web search that was done outside the privileged track.

Divide by plaintiff, then by injury, then by remedy. A plaintiff must show standing for each claim and each form of relief. Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022); Union Home. Holmes split four plaintiffs from one complaint into two groups with different outcomes. Your chart should look something like this.

Be candid about the circuit. In the Second, First, or Third Circuit, a targeted attack on Social Security numbers will almost certainly clear standing, and the credibility cost of pretending otherwise is real. Use your pages on the merits instead. In the Fourth Circuit, Holmes offers much more: argue that no plaintiff has alleged accessibility to many people, attack "information and belief" allegations of dark web posting as in Drivestream, and hold plaintiffs to the requirement of showing the combined probability. Preserve the Holmes argument elsewhere in a short section, because the split may yet draw Supreme Court attention. Elephant's own petition in Holmes (No. 25-1085) was dismissed on the parties' joint motion in May 2026.

Consider the consequences of winning. A standing dismissal is without prejudice. Plaintiffs may refile in state court with new theories. Tell the client this in writing before filing, because business people hear "dismissed" as "over." The general doctrine is laid out in Pleading and Attacking Standing in Federal Court.

Step 7. The Rule 12(b)(6) arguments, by likely value

Rank these for your state's law, since all are state-law questions.

1. Contract defenses and exemptions. Class waivers, arbitration, statutory exemptions such as the insurer exemption that defeated a Virginia claim in Attias v. CareFirst, Inc., No. 15-cv-882 (D.D.C. Sept. 13, 2023), and HIPAA or medical information carve-outs from the CCPA as in Young Consulting.
2. CCPA details. Five-day notice instead of thirty cost a plaintiff statutory damages in Young Consulting. Check data elements against Cal. Civ. Code § 1798.81.5, encryption, and whether the defendant is a "business" under § 1798.140.
3. Consumer statute reliance and causation. Plaintiffs often never read the privacy notice. Attias; In re Warner Music Group Data Breach, No. 20 Civ. 7473 (S.D.N.Y. Sept. 3, 2025).
4. Unjust enrichment. Malvitz v. Fincantieri Marine Group, LLC, No. 24-cv-238 (D.D.C. June 12, 2025); Alleruzzo v. SuperValu, Inc. (In re SuperValu), 925 F.3d 955 (8th Cir. 2019).
5. Implied contract. Stronger for former employees and where no document mentions security. Ramirez v. Paradies Shops, LLC, 69 F.4th 1213 (11th Cir. 2023).
6. Negligence. Duty is difficult to beat after Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018), and similar decisions. Consider the economic loss rule where state law supports it, as for bank plaintiffs in Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803 (7th Cir. 2018). A dismissal of a negligence count is the big prize, and the least likely.
7. Intrusion upon seclusion. Plaintiffs must allege intentional conduct by the defendant, not the hacker. In re Kemper Sports Management Data Breach Litigation, No. 24-CV-8503 (N.D. Ill. Jan. 5, 2026).

Note the trap in Bohnak: the Second Circuit treated injury-in-fact as satisfying the damages element at the pleading stage, and Dieffenbach said the same, so "no cognizable damages" is not a safe backup argument in those courts. Bohnak v. Marsh & McLennan Cos., 79 F.4th 276 (2d Cir. 2023).

Ask for a discovery stay during the motion under Rule 26(c). Courts vary, and in an MDL the conference under Rule 16.1 is the place to raise it.

Worked hypothetical: the defense map. Suppose Thistledown Home Health, a Maryland company with patients in nine states, is hit by ransomware that takes names, birth dates, Social Security numbers, and diagnoses for 300,000 people. The attackers post a directory listing on a leak site but no individual records. Five complaints arrive, three in the District of Maryland and two in Pennsylvania state court. Patients signed intake forms with no class waiver. Thistledown's lawyers map it out as follows. In Maryland, Holmes suggests that only a plaintiff who finds his own record on the leak site has a concrete injury, so a facial motion could dispose of most named plaintiffs without any evidence. In Pennsylvania state court, Dittman supplies duty and defeats the economic loss rule, and Article III doesn't apply. Removal is available under CAFA, and then a Section 1404 transfer to Maryland. The Pennsylvania plaintiffs will fight, arguing they have no standing in federal court under the very case Thistledown relies upon, so remand would follow. Thistledown decides to remove anyway, because federal class certification standards and Rule 23(f) review are worth the fight, and it tells its board in writing that a win may just move part of the case back to Pennsylvania. That's the right kind of decision: made early, on paper, with its downside priced in.

If you are the vendor

More and more, the hacked system belongs to a software or cloud provider, and the plaintiffs never heard of it until the letter arrived. The vendor's position differs in ways worth handling separately.

• Duty. Expect the argument that you created the risk by holding the data. Salesforce rejected the defense that a special relationship is required under California law. Do not build the whole motion on the absence of a relationship.
• CCPA status. Move on "service provider" status, and attach nothing but the complaint and documents it incorporates. Young Consulting granted that motion; Salesforce denied a similar one, relying on allegations that the vendor required clients to supply data and managed the servers. The contract language may matter later, on summary judgment, more than it does now.
• Standing and traceability. A vendor often has no list of the individuals affected. The customer sends the letters. So the vendor may not know for weeks whether a given named plaintiff is in the data. Ask the customer for that mapping under the agreement, and watch how the notice letters describe the incident, because in Salesforce the customers' letters supplied the plaintiffs' standing facts.
• Customers as co-defendants. Your customers want indemnity, and you want their cooperation. Consider a tolling and standstill agreement on cross-claims and a joint defense agreement, in writing, before sharing any analysis. Sharing counsel-track materials with a customer whose interests diverge from yours is a route to waiver.
• Each customer's forensic demand. Contracts often promise customers a root cause report. That promise points straight at Morrill's reasoning. Decide what you owe, write it as an operations document, and keep it apart from anything counsel commissions.

What the defense costs, roughly, and where to spend

We won't quote figures, since they vary too much, but the relative costs are stable. A second forensic firm is usually cheap compared with losing the privilege fight. A facial standing motion in a favorable circuit is the best value in the case. A factual standing motion costs far more, because it invites discovery. A full Rule 12(b)(6) attack on every count by state can be expensive and may only prune; in a nationwide case, focus on the counts that move settlement value, particularly CCPA statutory damages and multiple-damages consumer statutes. Expert work and class certification are the largest budget items if the case gets that far, which is why many defendants mediate before then. Ask the carrier early what it will fund, and get retention erosion and consent-to-settle terms clear, since cyber coverage varies widely.

Part Two: Evaluating and bringing the case

Step 1. Screen the breach

Run the McMorris factors before you run the client's facts.

• Targeted? A hack by a known group with a leak site is strong. A lost laptop or misdirected email is weak; both McMorris and Beck failed on this.
• Misused? Look at the group's site, the state attorney general notice portals, fraud reports from other victims, and press coverage. Brinker relied on posting for sale; Bohnak does not require it.
• Sensitive? Social Security numbers and medical data are at the top. Cards alone are at the bottom, as in Alleruzzo v. SuperValu, Inc. (In re SuperValu), 870 F.3d 763 (8th Cir. 2017). License numbers are in between, and vulnerable in the Fourth Circuit.
• Who is on the other side? A business with assets and insurance, or a thinly capitalized vendor? Sue the data owner, the vendor, or both, considering the Salesforce and Young Consulting split on whether a vendor is a CCPA "business" and on negligence duty.
• What contracts? Before filing, read the terms the client accepted. The hotel loyalty clause in Marriott ended years of work. Look for arbitration, class waivers, forum clauses, and choice of law. A nonmember client, who signed nothing, may be a more valuable class representative than a loyal one.

Step 2. Screen the client

Named plaintiffs get deposed, and their stories are tested. Here's what to ask at intake.

Be realistic with clients about recovery. Published settlements often deliver modest sums, and the service award available in some circuits is prohibited in the Eleventh under Johnson v. NPAS Solutions, LLC, 975 F.3d 1244 (11th Cir. 2020).

Step 3. Choose the court

Think through these in order: where can you get personal jurisdiction, what circuit does that put you in, does state court offer more, and will the case be removed anyway.

• Strong forums for an exposure-only plaintiff: the Second Circuit (Bohnak), the First (Webb), the Third (Clemens), the D.C. Circuit (Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017)), and the Seventh (Remijas).
• Hard forums: the Fourth, unless a named plaintiff has found her own data publicly accessible. The Eleventh needs misuse but accepts dark web posting.
• State court: consider it when your plaintiffs have only risk and mitigation. Georgia has been receptive under Collins v. Athens Orthopedic Clinic, P.A., 307 Ga. 555 (2019), and Bland. If you plead only state-law claims and the defendant removes, you may later note the defendant bears the burden of showing federal jurisdiction, and that it cannot both remove and say no one has standing.

Remember that a Panel transfer can override your choice. Since a transferee court generally applies its own circuit's reading of Article III, the fight over where an MDL goes is partly a fight over who has standing.

Step 4. Send pre-suit notices

Under Cal. Civ. Code § 1798.150(b), a consumer seeking statutory damages must give 30 days' written notice identifying the specific provisions violated. There's no notice requirement for actual pecuniary damages alone. The usual pattern is to file for actual damages and injunctive relief if time matters, serve the notice, then amend after the period expires. Do not file a claim for statutory damages early and hope; that's what cost a plaintiff in Young Consulting. Note that statutory cure is limited, since post-breach security improvements don't count as a cure. Some other state statutes have their own presuit requirements, so check each one before filing. Responding to a Consumer Class Action Demand Letter looks at the same moment from the recipient's side.

Step 5. Plead standing with facts

The difference between Drivestream and a surviving complaint is often a few paragraphs. Rule 11 applies; so does Ashcroft v. Iqbal, 556 U.S. 662 (2009). Plead what the client actually knows, and plead the sources.

Sample paragraphs, adapted to your facts:

On [DATE], [GROUP], a ransomware group identified in [PUBLIC SOURCE], listed [DEFENDANT] on its leak site and stated that it held [DATA TYPES]. On [DATE], Plaintiff received an alert from [SERVICE] that her [DATA TYPE] was found at [DESCRIPTION OF LOCATION]. A true copy is attached.

Plaintiff spent approximately [X] hours on [DATES] [SPECIFIC TASKS]. That time was taken from [PAID WORK / SPECIFIC ACTIVITY]. She paid $[Y] on [DATE] for [SERVICE], because the coverage offered by Defendant does not [SPECIFIC GAP].

Plaintiff has never knowingly transmitted her Social Security number over an unsecured channel, stores documents containing it in [PLACE], and to her knowledge has not been notified of any other breach involving it.

Do these things as well:

• Tie the forward-looking request to a real risk. If you want an injunction, allege specific ongoing retention of data and unremediated weaknesses, keeping in mind that Webb treated your own allegation of improved security against you. Plaintiffs in Union Home kept injunctive relief only for measures that addressed harm from the initial breach.
• Plead specific security failures for the CCPA and negligence counts, since Warner Music shows a split over whether the breach alone suffices. Look at state attorney general filings, prior incidents, and the vulnerability involved.
• Plead the promise. Quote the privacy policy and handbook. Clemens had an express term; Paradies had nothing and lost.
• Think about subclasses by state. Marriott and the choice-of-law deferral in Salesforce show this will matter later.

Step 6. Compete for leadership

Under Rule 23(g)(3), the court looks at investigation work, experience, knowledge of the law, and resources. In re Geisinger Health Data Security Incident Litigation, No. 4:24-cv-01071 (M.D. Pa. Jan. 30, 2025), shows a contested application between strong groups. Your filing should show work specific to this breach, such as the dark web research and expert retention. Self-organizing a slate often beats a contest, and the 16.1 report will address leadership anyway.

Worked hypothetical: the voicemail. Suppose a retired teacher, Ms. Okafor, calls about a letter from a benefits administrator stating that her Social Security number and bank details "may have been accessed." She lives in Richmond, Virginia. A leak site named the administrator. She has not found her data, spent no money, and spent perhaps two hours checking her statements. She signed nothing with the administrator; her former school district did. In the Fourth Circuit, she probably has no standing today under Holmes. Taking her case in Richmond's federal court would be a mistake unless a dark web search turns up her record. Her lawyer has three better options: run a commercial dark web search and revisit the analysis if it finds her data; add a client in a friendlier circuit and file where the administrator is headquartered if that is outside the Fourth; or file in Virginia state court on negligence, with her modest actual loss, and expect removal followed by a fight over remand. The lawyer also tells her the likely recovery is small and that she would need to sit for a deposition. She decides that she'd like to see what the search shows before deciding. That's a sound result of a thirty-minute intake call.

Part Three: Discovery

What's in play

Early discovery usually covers: the incident timeline, the forensic reports, vendor contracts, security policies and audits (including penetration tests and prior findings), budgets, board materials, regulator correspondence, notice drafts, and custodians in IT and legal. Named plaintiffs face requests on their other breaches, credit reports, and devices. Protect security details with a tiered protective order; plaintiffs' experts can review sensitive configuration under outside-counsel-and-expert-only terms. For overall mechanics, the Nonparty Discovery Toolkit covers subpoenas to the forensic firm.

The forensic report motion: for plaintiffs

Don't start with the report. Start with the things that make it undefendable. Serve targeted requests for:

1. All master services agreements and statements of work with every incident response vendor for several years before the incident. Capital One, Premera, Dominion Dental.
2. Engagement letters and any amendments.
3. Invoices and the accounting codes, including re-designations. Capital One mentions the "business critical" fund and later re-coding as legal.
4. A list of every recipient of any report, summary, or slide deck. Capital One, Clark Hill.
5. Regulator correspondence mentioning root cause. Morrill.
6. An interrogatory on the source of the company's understanding of the cause. Clark Hill answered "solely" through counsel and consultants, which destroyed its two-track story.
7. A Rule 30(b)(6) topic on the investigation's purpose and on who at the company signed the vendor contract. The designee's testimony in Rutter's decided that motion.

Then move under Rule 37. Stress that the burden is on the party resisting. Ask for in camera review, as in Clark Hill, and in the alternative argue substantial need under Rule 26(b)(3)(A)(ii) if logs were lost and the report is the only record. The decision may be reviewed by the district judge on objection, which is what happened to the magistrate's order in Capital One.

The forensic report motion: for defendants

Win it with evidence, in advance.

• Provide declarations from outside counsel and the security lead, specific and dated, describing the distinct tracks. Clark Hill's declarant said only that the vendor's work made the report unnecessary for continuity, and the court said that's not the same thing.
• Produce the business track without a fight. Producing it supports your position. Target rested on that contrast, and Premera and Clark Hill distinguished Target because no such separate production existed.
• Offer in camera review if the report is clean. If it has pages of remediation advice, know that before you offer.
• Log carefully. The December 2025 amendments to Rule 26(f) and Rule 16(b) push the parties to work out method and timing of privilege logs early. See Preparing a Privilege Log.
• Prepare your Rule 30(b)(6) witness on purpose and chronology, truthfully and without coaching the facts. Preparing a Witness for Deposition discusses the line.
• Get a Rule 502(d) order under Fed. R. Evid. 502 entered early, so that inadvertent production doesn't become waiver.
• If you lose before the magistrate judge, objections under Rule 72(a) are due within 14 days and are reviewed deferentially, though purely legal errors get what the Capital One court treated as effectively de novo review. Plan for production under the protective order.

Mind the middle ground. A protected report does not hide facts. Upjohn Co. v. United States, 449 U.S. 383 (1981), lets plaintiffs ask witnesses what they know, and forensic images and logs are ordinary documents. The fight is over the expert's synthesis. So sensible defendants sometimes trade: produce factual exhibits, timelines, and indicators in exchange for peace on the analysis.

Worked hypothetical: the distribution problem, from both chairs

Suppose Larkhaven Benefits hires a forensic firm through outside counsel after a breach, and that firm also wrote last year's penetration test. Counsel's letter describes a new scope. The firm's report contains eleven pages of findings and four pages of recommendations. The CISO receives it "for accuracy review." So does the audit committee chair.

Plaintiffs' counsel serves the requests described above. The master agreement arrives, along with invoices that were coded to the security budget for the first two months. At the Rule 30(b)(6) deposition, the CISO says he used the recommendations to prioritize patching. Plaintiffs now have the Capital One contract comparison, the payment facts, the Clark Hill remediation content, and the distribution. They move to compel and ask for in camera review.

Larkhaven's counsel has to make a decision. It can fight, using a declaration that the new scope differed. Reading the opinions honestly, the odds are poor, and a written ruling that the report was an ordinary business record may also be used in the state court cases and by regulators. Or it can negotiate: produce the findings and facts under the protective order with a Rule 502(d) provision, withhold counsel's communications and the legal analysis, and redact only what truly reflects legal advice. Larkhaven picks the second course. It loses a document it never should have counted on, and it keeps the credibility it needs for the standing and certification fights. It also rewrites its protocol for next time.

Expert work

Plaintiffs usually need a liability expert on security standards, perhaps a damages economist, and maybe a dark web specialist. Defendants need a responding security expert who was not on the privileged track, because testifying experts' materials are discoverable within the limits of Rule 26(b)(4), and a consultant who crosses over can open that door. Keep testifying and consulting roles separate from the day they're hired.

Part Four: Class certification and appeal

Plaintiffs need a class definition that doesn't sweep in people with no injury, a representative whose contract matches the class, and a damages model tied to the liability theory under Comcast Corp. v. Behrend, 569 U.S. 27 (2013). Brinker left the averaging model intact over a dissent, and Marriott's overpayment model got through a district court, though the Fourth Circuit never reviewed it. Use a Rule 23(c)(4) issue class with caution. Marriott's lost its only superiority rationale when the damages classes fell.

Defendants should attack typicality where contract terms differ, predominance where proof of causation is individualized, and superiority for issue classes. Assert that some class members have no standing under TransUnion's statement that every class member needs standing to recover damages; the certification-stage question remains open after the dismissal in Laboratory Corp. of America Holdings v. Davis, No. 24-304 (U.S. June 5, 2025). Raise class waivers before certification, since Maldini v. Accenture LLP (In re Marriott), 78 F.4th 677 (4th Cir. 2023), says that's when they get decided.

Either side has 14 days to petition under Rule 23(f). The Fourth Circuit granted review twice in Marriott. Prepare the petition before the order issues. Further detail is in Winning or Defeating Class Certification.

Part Five: Settlement

When. Often after the standing ruling, sometimes before. Wawa's agreement in principle came after one session of almost twelve hours. Timing depends on insurance, whether the forensic motion is pending, and the regulators' posture.

The deal. Standard terms: a fund or claims-made structure; tiers for documented loss, lost time, and pro rata or flat payments; credit monitoring; security commitments for a set period; notice and administration; service awards where allowed; fee provisions. See the term sheet in the toolkit.

Avoid approval trouble.

• Keep fee negotiations after the relief terms, as the parties did in In re Wawa, Inc. Data Security Litigation, 141 F.4th 456 (3d Cir. 2025).
• Avoid reversion of unawarded fees, and think twice about clear sailing. In re Wawa, Inc. Data Security Litigation, 85 F.4th 712 (3d Cir. 2023), treats both as warning signs. Wawa amended its deal twice in response to an objector.
• Be ready to defend the injunctive component's real value. Commitments the company was already making get less credit.
• Serve the notices to federal and state officials required by 28 U.S.C. § 1715, since final approval can't issue until 90 days after service. Fifteen attorneys general joined an amicus filing in the Wawa appeal, so assume someone reads them.
• Expect a professional objector and build the record: declarations from the mediator, a lodestar cross-check, and comparable settlements. In re Retina Group of Washington Data Security Incident Litigation, No. DKC 24-0004 (D. Md. July 21, 2025), shows a court trimming a fee request to 30 percent.
• Keep the release tied to the incident. Wawa required a clarification to avoid releasing employees' claims in a separate track.

Claim rates. Plan for low numbers, and spend money on direct notice rather than publication. Wawa automatically delivered gift cards to app users to boost participation after objection, a step worth copying when the defendant has a direct channel to customers.

Common mistakes

Defense mistakes:

• Letterhead privilege. Adding counsel to a pre-existing vendor contract and changing nothing else. Premera, Capital One.
• Circulating the report. Forwarding to the board, auditors, IT, insurers, or the FBI without first checking with counsel about the consequences.
• Telling the court all your knowledge comes from counsel. It defeats the two-track claim, as Clark Hill learned.
• Omitting the class waiver from the first motion. Even a successful late assertion costs years.
• Treating dismissal as the end. Standing wins can mean state court.
• Overclaiming in the letter. "No evidence of misuse" written the day before a leak site post becomes an exhibit on concealment.
• Filing the forensic expert's declaration in support of a standing motion without weighing waiver.
• Delaying the insurer. Late notice and unapproved vendors can cost coverage.

Plaintiff mistakes:

• Filing first and screening later. A client whose card visit predates the breach window is an embarrassment, as in Brinker.
• Generic complaint. "Information and belief" dark web allegations failed in Drivestream.
• Ignoring the client's contract. Marriott.
• Statutory damages too soon. Young Consulting.
• Treating injunctive relief as free. A request with no facts about a coming second breach hands the defense an easy partial win. Webb, Holmes.
• Overreliance on credit monitoring cost. If the defendant offered it free, the plaintiff must explain why her purchase was reasonable.
• Asking for the report before getting the contracts. A premature motion educates the defendant.
• Forgetting the named plaintiff's deposition. Other breaches and careless habits get explored, and an alternative-cause story can decide traceability.

Nothing here is a substitute for advice tailored to your facts; this guide is general information only. If you are on either side of one of these cases and want a second look at the forum or the forensic structure, we are happy to talk.

Related Documents

Related Articles

• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the doctrine and cases behind each step.
• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: what the letter must say.
• Missed Federal Deadlines: Rule 6, Excusable Neglect, and the Deadlines a Court Cannot Excuse: the removal and Rule 23(f) clocks.
• Rule 502 and Inadvertent Production: Waiver, Clawback Agreements, and Why Every Case Needs a 502(d) Order: keeping a production from becoming a waiver.
• Preparing a Witness for Deposition: What Is Proper, What Is Coaching, and What the Other Side Can Discover: preparing the corporate designee.

Related Guides

• Responding to a Data Breach: The First Seventy-Two Hours: the operational response.
• Removing or Remanding a Class Action Under CAFA: A Practical Guide: the forum fight.
• Practicing in an MDL: A Practical Guide for Plaintiff and Defense Counsel: consolidated practice.
• Pleading and Attacking Standing in Federal Court: A Practical Guide: the general playbook.
• Winning or Defeating Class Certification: A Practical Guide: the certification record.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: the insurance step.
• Responding to a Consumer Class Action Demand Letter: the presuit stage.

Related Checklists

• Data Breach Litigation Readiness Checklist: A Practical Checklist: this guide in task form.
• Preparing a Privilege Log: A Practical Checklist: logging the counsel track.

Related Toolkits

• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: the templates mentioned here.
• Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege: forensic vendor subpoenas.