What you say during a cyber breach can — and will — be used against you
Summary
Communications made during the initial chaotic hours of a cyber incident can have significant legal and financial repercussions long after the attack. What is said and documented can become evidence in litigation and investigations, and simply copying legal counsel does not automatically grant attorney-client privilege.
IFF Assessment
This article highlights how internal communications during a cyber breach can be used against an organization in legal proceedings, increasing the potential negative outcomes of an incident.
Defender Context
Defenders need to be acutely aware that all communications during an incident response are potentially discoverable. This necessitates careful documentation and clear communication protocols, emphasizing factual reporting over speculative or emotionally charged language, especially when legal counsel is involved.