Why it's become a primary risk-management tool

• Incidents are treated as inevitable. Boards and regulators (APRA CPS 234, ASIC director duties) have moved from "prevent" to "prepare" — meet an objective standard of readiness, not a guarantee of no breach.
• Public examples make it unignorable. Optus and Medibank turned data breaches into board-level conversations; the "Australia under attack" narrative did the rest.
• Notification chaos. Everyone knows someone who's received a breach letter — the externalised cost is now visible.
• Capital and licensing pressure. AFSL holders, APRA-regulated entities, and government suppliers increasingly can't operate without baseline controls — and increasingly can't get those controls underwritten without a policy in place.

What's typically in a cyber policy

Every cyber policy splits along one line:

• First-party — losses the insured suffers itself: business interruption, IR and recovery costs, ransom payments, stolen funds, data restoration.
• Third-party — liability the insured owes someone else from the same event: privacy and security claims, regulator investigations and fines (OAIC, ASIC), PCI assessments, D&O exposure.

The same incident can trigger expenses on both sides — and your forensic findings feed each of them differently.

• Pratt Holdings v Commissioner of Taxation (2004) 136 FCR 357 — a loss-assessment firm (a pure third party, not the lawyer's agent) prepared a report so the company could instruct its lawyers. The Full Federal Court held the report was privileged. Authority that third-party expert reports can attract LPP, provided the dominant purpose at the time of creation was to enable legal advice.
• Esso Australia Resources v Commissioner of Taxation (1999) 201 CLR 49 — High Court replaced the old "sole purpose" test with dominant purpose at common law, aligning it with the Evidence Act. The test now applied to every expert-report privilege fight.
• FCT v Spotless Services (1996) 186 CLR 404 — defined "dominant" as "the ruling, prevailing or most influential purpose". Useful when a report has plausible legal and operational drivers.

• AWB Ltd v Cole (No 5) (2006) 155 FCR 30 — investigation reports commissioned during the Cole inquiry. Young J's reasoning is the standard reference for how courts unpick the real purpose of a multi-purpose investigation, including who instructed it, who saw drafts, and how the scope was framed.
• Propend Finance (1997) 188 CLR 501 — confirmed that confidential communications with third parties (including experts) attract litigation privilege where made for the dominant purpose of existing or anticipated litigation.
• Glencore v Commissioner of Taxation (2019) 265 CLR 646 — High Court reaffirmed privilege as a substantive immunity, not merely a rule of evidence. Reinforces that a properly-claimed privilege is robust — but only if the underlying conditions are met.

The case for

• Candour in the report. If the author knows the report cannot be weaponised by a future plaintiff, they will name root causes plainly — "patch was 14 months overdue", "MFA was off for the admin tier" — instead of hedging.
• Frank advice from counsel. Lawyers can give a real risk assessment off the back of a real factual record, rather than triangulating around a sanitised public-facing version.
• Strategic optionality. Privilege gives the insured time to decide what to disclose, to whom, and on what terms — regulator, class action, board, market — without the report being already in the wild.
• Reduces the chilling effect. Without privilege, organisations commission shallower investigations or none at all, because every finding becomes a future exhibit. Worse incident response overall.
• Protects the investigative process. Drafts, working hypotheses, and ruled-out theories don't end up cherry-picked in cross-examination.

The case against

• Accountability. Victims, regulators, and the public have a legitimate interest in knowing what went wrong. Privilege can shield genuine corporate failure from scrutiny.
• Information asymmetry in litigation. The defendant company knows exactly what happened; class-action plaintiffs are forced to litigate blind, or fight expensive privilege battles before they get to the merits.
• Regulatory under-enforcement. ASIC, OAIC, and APRA can struggle to build cases when the best evidence sits behind a privilege claim. The threat of enforcement softens.
• Encourages "law-washing". Routing routine operational reviews through a law firm purely to claim privilege distorts how investigations are commissioned and scoped.
• Public-good information is suppressed. The cyber community learns less from each major breach because the technical detail of how it happened is locked away.

What happened

• Class action arising from the September 2022 breach (~9.5m affected). Applicants sought production of Deloitte's forensic and management review.
• Optus claimed both advice and litigation privilege over the report.
• Court found at least three concurrent purposes — legal advice, identifying root cause for management, and reviewing cyber-risk policies. None was dominant.
• CEO's public 3 October 2022 announcement framed the review as an external assurance exercise — before counsel was instructed. Board resolutions repeated the management/assurance framing.
• Only the General Counsel swore evidence. No CEO, no Board, no Ashurst affidavit. Jones v Dunkel applied. The GC was found not to have been acting solely as legal adviser when he engaged Deloitte.

The lesson

• Privilege is decided on contemporaneous objective evidence — engagement letters, Board papers, public statements. Retrospective characterisation will not save a multi-purpose engagement.
• The dominant-purpose test is strict: a substantial or co-equal legal purpose is not enough.
• External counsel (not the company) should engage the forensic firm.
• The engagement letter and Board resolution should articulate the dominant legal purpose unambiguously.
• Control public messaging — don't let the CEO publicly frame the work as a management review.
• Be prepared to lead evidence from the actual decision-makers (CEO, Board), not just the GC.

What happened

• October 2022 breach (~3.9m customers; ~520GB exfiltrated, including mental-health and termination data) by a REvil-linked actor. Initial access via stolen third-party contractor credentials.
• Medibank engaged multiple firms under MinterEllison's instruction — Deloitte (root-cause analysis, post-incident review, CPS 234 report for APRA), CrowdStrike (IR/forensics), and CyberCX / Threat Intelligence (ransom-payment and OAIC-notification advice).
• The privilege fight ran in the consumer class action, alongside parallel OAIC civil-penalty proceedings, an APRA enforceable-undertaking process, and a shareholder class action.

The result — and the lesson

• Not privileged / produced: the three Deloitte reports. Dominant purposes were customer/market reassurance, satisfying APRA, and avoiding an APRA-commissioned review. Public ASX statements about implementing PIR recommendations would have waived privilege regardless.
• Upheld as privileged: CrowdStrike, CyberCX, Threat Intelligence material tied to legal advice on ransom payment, OAIC notification and Privacy Act compliance.
• Lesson: structural separation of workstreams can preserve privilege over some forensic material — but a publicly-announced "external review" with regulator-facing scope is almost always cooked.
• Forensic firms working under counsel's instructions, on a narrowly-scoped legal-advice question, fared better than firms hired to produce the headline post-incident report.

What happened

• AFS-licensee financial advice network. Nine cyber incidents across its authorised representative practices between June 2014 and May 2020 — BEC, phishing, ransomware, and a months-long file-server compromise affecting thousands of clients.
• ASIC pleaded breaches of s 912A(1)(a) and (h) Corporations Act 2001 (Cth) — efficient/honest/fair, and adequate risk-management systems.
• Theory: cyber-risk management is a risk-management system within s 912A.
• Rofe J declared contraventions from 15 May 2018 to 5 August 2021.
• Remedy: declarations, s 1101B compliance orders (engage Security in Depth under ASIC supervision) and $750,000 costs.

The lesson for forensic experts

• Adequacy of cyber controls is "highly technical" and requires "the evidence of a relevantly skilled person". The forensic expert is the only person who can answer the central legal question.
• The IR forensic report becomes the regulator's primary evidentiary record — incident timelines, scope of compromise, and control gaps were the agreed factual matrix on which liability was admitted.
• Findings about delayed detection, unpatched systems, and AR-network gaps map directly onto s 912A elements.
• Scoping language, root-cause attribution, and timeline precision in the report drive the contravention period — and therefore the size of the case.

The matter

• Small AU professional services firm on M365 Business Basic.
• Three mailboxes compromised: Reception, Admin, Accounts.
• Phishing emails to Reception and Admin in April 2024 — fake Microsoft voicemail lure, credentials harvested via a lookalike sign-in page.
• Accounts separately compromised in August via OWA from overseas IPs.
• Persistence via covert inbox rules redirecting financial keywords externally, and a third-party Graph-API app (MailPilot) granted broad delegated permissions.

The outcome

• Threat actor monitored a live property settlement via the Accounts mailbox.
• Lookalike domain (david.greenfie_l_d@outlook.com) used to send altered banking details to the third-party purchaser mid-settlement.
• Settlement balance paid into the fraudulent account.
• Detected ~5 months after the first compromise; sign-in logs already overwritten under the 30-day Business Basic retention.
• ~330 financial emails confirmed redirected externally before the rules were found and removed.

• Engagement letter vs forensic agreement — whose paper governs the work.
• Privilege playbook vs normal tempo — protective process requires careful control, runs against the normal practice of forensic provider/client procedures.
• Witness code of conduct vs the hand that feeds — your professional obligations and compliance with the code vs the commercial reality of repeat work from breach counsel.
• Calling exfiltration vs not — the framing that triggers (or ends) months of follow-on work.

• Broker vs coverage counsel — broker advocates for the insured to maximise recovery; coverage counsel works for the insurer to scope and contest it.
• MSP vs forensic provider — the incumbent IT/MSP and the incoming forensic firm each have a stake in where the blame for the incident lands.
• Insurer vs MSP — the MSP wants the claim to fund upgrades that should already have been in place; the insurer's policy excludes betterment.

What counsel wants

• Engaged through the lawyer, not direct with the insured.
• All communications routed via counsel; no IT-team Slack channels, no status decks for the board.
• No premature written conclusions, no sub-contractors without notice.
• Drafts go to counsel only. Iterative review before anything reaches the insured.
• Engagement letter, board paper, and public statements all point at the same legal purpose.

What the firm normally does

• Direct comms with the client's IT team to get hands on the environment fast.
• Stand-up Slack channels, daily status decks for the insured's leadership.
• Triage findings shared as they emerge, before anything is locked down.
• Sub-processors (cloud SIEMs, AI triage, threat intel) used by default.
• Final report shaped end-to-end by the technical team, not the lawyer.

What the evidence usually shows

• Logs that establish access but not exfiltration.
• Retention gaps that prevent confirmation either way.
• Threat-actor tradecraft consistent with bulk download — but not directly observed.
• A mailbox or share that could have been downloaded; available evidence cannot resolve the question.

Where the commercial pressure pulls

• A finding toward exfiltration triggers e-discovery, data-subject identification, breach-mapping and notification work — often months of follow-on engagement for the same firm.
• A finding away from exfiltration ends the matter and the billing.
• The firm that calls "exfiltration likely" earns more from the matter than the firm that calls it "could not be determined."

1. Did unauthorised access or disclosure occur?

• Privacy Act s 26WE — eligibility turns first on whether personal information held by the entity has been accessed by, or disclosed to, an unauthorised person, or is lost in circumstances where unauthorised access is likely.
• The report needs to say, in evidence: what data, in what systems, was reachable by whom, when, and with what indicators that access actually occurred.
• "Reachable in theory" is not the same as "accessed in fact." Lawyers will read findings of access very differently to findings of exposure.
• Logs, file-touch timestamps, exfiltration indicators, attacker tooling — these are the facts the eligible-breach analysis is built on.

2. Is there a real risk of serious harm?

• Privacy Act s 26WG — even where access occurred, notification is only required where a reasonable person would conclude the access is likely to result in serious harm to any of the affected individuals.
• "Serious harm" includes physical, psychological, emotional, financial, and reputational harm.
• The report drives this through the dataset (identifiers, financials, health, credentials) and the cohort (how many people, how vulnerable, what context).
• Remedial action taken before harm materialises (s 26WF) can take the matter outside the scheme — another reason the report's containment timeline matters.

Why it falls to counsel

• The entity is statutorily on the hook but rarely has the expertise. The risk is real and current; the knowledge sits with specialists.
• It falls to legal practitioners to stay across the threat landscape: how identity documents, financials, health data, credentials, and behavioural data each map to specific downstream harms.
• That's not a one-off uplift. Fraud typologies move — what was theoretical for a leaked Medicare number two years ago is now an active fraud pattern.
• Counsel reads the forensic report and asks: for this dataset, what could realistically happen to a person, by whom, and how soon?

How it works in practice — bucketing

• Counsel takes a view, on the facts you've established, of the types of information exposed for each cohort of individuals.
• Affected individuals get sorted into buckets — typically by data class and severity (e.g. name + email, name + DOB + address, identity documents, financial credentials, health information).
• Each bucket is then either in scope for the notification campaign or out of scope, based on the harm analysis applied to that bucket.
• The forensic report determines which individuals fall into which bucket — so the precision of your dataset findings directly drives the size and shape of the notification campaign.

What's still running

• OAIC — s 26WK statement, possible CII inquiry, determination of serious breach.
• Sector regulators — APRA (CPS 234) and ASIC (director duties) re-asking the same questions through different lenses.
• Class actions — plaintiff firms build the case theory off your bucketing and timeline.
• D&O claims — what the board knew and when, anchored by your incident timeline.
• Contractual claims — B2B customers triggering notification clauses and audit rights.

Subrogation — the insurer's second claim

• Once the insurer pays, common-law indemnity plus the policy's subrogation clause let it step into the insured's shoes.
• Fastest-growing area of cyber litigation in Australia.
• Targets: MSPs, systems integrators, security vendors (EDR / SOC / vCISO), supply-chain software, management consultants whose pre-incident advice expanded the loss.
• Your causation analysis — what failed, in what order, which control would have stopped it — is one document subrogation counsel works from, though they often commission a separate report specifically for the litigation.