The proposed representative plaintiffs in a class action arising from a cyberattack brought a motion for the production of third-party cybersecurity reports (the Mandiant Reports) prior to cross-examining the defendants' affiant on a certification motion.
The defendants opposed production, claiming privilege.
The court held that by relying on the investigation's findings regarding the size and scope of the class in their affidavit, the defendants waived privilege over those specific aspects of the reports.
Applying principles of waiver, relevance, and proportionality, the court ordered the defendants to produce only the excerpts of the reports relating to the size and scope of the class.
