Leonard v. McMenamins Inc

Opinion

1 2 3

4 5 UNITED STATES DISTRICT COURT 6 WESTERN DISTRICT OF WASHINGTON AT SEATTLE 7 ANDREW LEONARD et al., CASE NO. C22-0094-KKE 8 Plaintiffs, ORDER GRANTING PLAINTIFFS’ FIRST 9 MOTIONS TO COMPEL AND GRANTING v. IN PART AND DENYING IN PART 10 PLAINTIFFS’ SECOND MOTION TO MCMENAMINS INC, COMPEL 11 Defendant. 12 13

14 This matter comes before the Court on Plaintiffs’ motions to compel. Dkt. Nos. 39 & 49. 15 The Court heard oral argument and for the reasons provided below grants the first motion and 16 grants in part and denies in part the second motion. 17 I. BACKGROUND 18 On December 12, 2021, Defendant McMenamins suffered a ransomware attack that “may 19 have affected the personal information of certain current and previous employees.” Dkt. No. 18 20 ¶ 29 (December 30, 2021 Notice of Data Breach provided in the Amended Complaint). 21 McMenamins retained Stoel Rives LLP to “represent it in regard to the ransomware attack.” Dkt. 22 No. 43 ¶ 3. On December 13, 2021, Stoel hired Stroz Friedberg to “provide consulting and 23 technical services regarding a ransomware incident on behalf of McMenamins, Inc. (“Client”), 24 1 which is Counsel’s client.” Id. at 6–25. Stoel and Stroz Friedberg agreed to at least four 2 supplemental scopes of work. Dkt. No. 48 at 109–123.1 On May 22, 2022, Stroz Friedberg 3 published a document entitled “McMenamins Investigation Report.” Dkt. No. 43 at 27–41. 4 On January 28, 2022, Plaintiffs, current and former employees of McMenamins, filed this 5 putative class action lawsuit against McMenamins. Dkt. No. 1. On May 13, 2022, Plaintiffs filed 6 their first amended complaint (the operative complaint) with causes of action for negligence, 7 breach of contract, breach of implied contract, unjust enrichment/quasi-contract, breach of 8 fiduciary duty, breach of confidence, bailment, violation of the Washington Consumer Protection 9 Act (“CPA”), and declaratory relief. Dkt. No. 18 ¶¶ 130–234. 10 On September 14, 2023, Plaintiffs filed their first motion to compel seeking more fulsome 11 responses to their first set of requests for production (“RFPs”) and interrogatories and to have 12 McMenamins’ privilege objections overruled. Dkt. No. 39. As part of the briefing on this motion,

13 the parties attached highly redacted copies of the engagement letter with Stroz Friedberg (Dkt. No. 14 43 at 6–25), the scopes of work with Stroz Friedberg (Dkt. No. 48 at 109–123), and the Stroz 15 Friedberg report (Dkt. No. 43 at 26–41). Plaintiffs also provided a copy of McMenamins’ full 16 privilege log for the Court’s review. Dkt. No. 48 at 32–108. Notably, none of the redacted 17 documents had been listed by McMenamins on its privilege log. Id. On October 19, 2023, 18 Plaintiffs filed their second motion to compel seeking production of financial documents in 19 response to a category of requests in their second RFPs. Dkt. No. 49. 20 After oral argument on both motions and without objection from either party, the Court 21 ordered McMenamins to produce the engagement letter with Stroz Friedberg, related scopes of 22 work, and the Stroz Friedberg report for in camera review. Dkt. No. 62. McMenamins complied,

24 1 For legible versions of exhibits G, H, and I, see the praecipe at Dkt. Nos. 61-1–61-3. 1 providing the engagement letter, second supplemental scope of work,2 and two Stroz Friedberg 2 reports3 for the Court’s review in camera. 3 II. LEGAL STANDARD 4 “Parties may obtain discovery regarding any nonprivileged matter that is relevant to any 5 party’s claim or defense and proportional to the needs of the case.” Fed. R. Civ. P. 26(b)(1). If “a 6 party fails to answer an interrogatory submitted under Rule 33” or “fails to produce documents ... 7 requested under Rule 34,” the requesting party can “move for an order compelling an answer [or] 8 production.” Fed. R. Civ. P. 37(a)(3)(B). The party seeking to compel discovery has the burden 9 of establishing that its requests are relevant. Fed. R. Civ. P. 26(b)(1). Once this showing is made, 10 the party opposing production must “carry a heavy burden of showing why discovery” should be 11 denied. Blankenship v. Hearst Corp., 519 F.2d 418, 429 (9th Cir. 1975). 12 III. ANALYSIS 13 A. Plaintiffs’ First Motion to Compel is Granted. 14 In their first motion to compel, Plaintiffs ask the Court to (1) overrule McMenamins’ 15 privilege objections to Interrogatories 3–25,4 (2) overrule McMenamins’ “incorporation by 16 reference” objections, and (3) find McMenamins waived its privilege objections or find the 17 privileges do not apply to the Stroz Friedberg report and related communications.5 Dkt. Nos. 39 18 & 46. McMenamins opposes the motion on the grounds that (1) the motion to compel is premature 19

20 2 McMenamins produced only one scope of work for in camera review even though Plaintiffs provided three additional redacted scopes of work in support of their first motion to compel. See Dkt. No. 48 at 114–123. McMenamins did 21 not provide any explanation for why these additional scopes of work were not provided to the Court. 3 The Court will refer to these two reports in the singular as they appear to contain the same information in different forms. 22 4 Plaintiffs’ motion asks the Court to also overrule other categories of McMenamins’ interrogatory objections. Dkt. No. 39 at 9–10. Based on McMenamins’ representations during oral argument, the Court understands McMenamins 23 is only withholding information based on its privilege objections. 5 Plaintiffs also raised disputes regarding search methodologies and McMenamins’ response to RFP 9. Based on the representations made by counsel during oral argument, the Court resolved these disputes and ordered McMenamins 24 to produce additional responsive documents and McMenamins’ search methodologies. See Dkt. No. 62. 1 and moot,6 (2) the Stroz Friedberg report is protected under the attorney-client privilege and work 2 product doctrine, and (3) related communications and information are protected under the attorney- 3 client privilege. Dkt. No. 42 at 8–17. 4 1. McMenamins must produce the full Stroz Friedberg report, engagement letter, scopes of work, and related communications. 5 a. The Stroz Friedberg report is not work product. 6 “The work-product doctrine protects from discovery documents and tangible things 7 prepared by a party or his representative in anticipation of litigation.” United States v. Richey, 632 8 F.3d 559, 567 (9th Cir. 2011) (cleaned up). “To qualify for work-product protection, documents 9 must: (1) be prepared in anticipation of litigation or for trial and (2) be prepared by or for another 10 party or by or for that other party’s representative.” Id. Both parties agree the Stroz Friedberg 11 report was, at minimum, used for both business and legal advice making it a “dual purpose” 12 document. See Dkt. Nos. 42 at 15, 46 at 6. The Court analyzes whether “dual purpose” documents 13 can be withheld as protected work product under the “because of” test, where the Court reviews 14 “the totality of the circumstances [to] determine whether the document was created because of 15 anticipated litigation, and would not have been created in substantially similar form but for the 16 prospect of litigation.” Richey, 632 F.3d at 568 (cleaned up). Under this standard, where a 17 document would have been created in a substantially similar form regardless of potential litigation, 18 work product protection does not apply. Id. 19 Numerous courts have considered similar disputes over cybersecurity consultant reports in 20 the context of data breach litigation. In evaluating whether the given report should be withheld as 21 protected work product, courts consider factors including whether the report provides factual 22

23 6 Based on the parties’ representations at oral argument, the motion is not premature; the parties are at an impasse regarding the Stroz Friedberg report and related information and the adequacy of McMenamins’ supplemental interrogatory responses. Where relevant, the Court notes disputes that have been mooted by subsequent agreement of 24 the parties, and this order does not substantively address the mooted issues. 1 information to the impacted entity (and others), whether the report constitutes the only 2 investigation and analysis of the data breach, the types of services provided by the consultant, the 3 relationship between the consultant and the impacted entity, and importantly, whether the report

4 would have been prepared in a substantially similar form absent the anticipation of litigation. See, 5 e.g., In re Experian Data Breach Litig., No. SACV 15-01592AG (DFMx), 2017 WL 4325583 6 (C.D. Cal. May 18, 2017); In re Target Corp. Customer Data Sec. Breach Litig., MDL No. 14- 7 2522, 2015 WL 6777384 (D. Minn. Oct. 23, 2015); Guo Wengui v. Clark Hill, 338 F.R.D. 7 8 (D.D.C. 2021). 9 McMenamins directs this Court to In re Target Corp. Customer Data Security Breach 10 Litigation, where the court denied a motion to compel production of a cybersecurity consultant’s 11 report and related communications on work product grounds. 2015 WL 6777384, at *2–3. 12 However, unlike here, Target had engaged in a two-track investigation of the subject data breach.

13 On one track, it conducted its own business investigation to learn “how the breach happened and 14 [how] Target could respond to it appropriately.” Id. at *2. Information arising from this 15 investigation was not privileged and had been disclosed. On the second track, “Target established 16 its own task force and engaged a separate team from Verizon to provide counsel with the necessary 17 input.” Id. Material generated from this second track was withheld. 18 While McMenamins argues that the same is true here, the record demonstrates otherwise. 19 See Dkt. No. 42 at 16 (“McMenamins conducted its own internal investigation, which it has 20 produced information on in discovery.”). McMenamins’ discovery responses contain no 21 information about what any other allegedly non-privileged internal investigation entailed, the 22 results of any such investigation, or McMenamins’ response thereto. To the contrary,

23 McMenamins withholds nearly all information related to the breach and its response to it on 24 privilege grounds. See, e.g., Dkt. No. 40 at 77–78 (For example, in response to interrogatory No. 1 10, asking for factual information about the data breach, McMenamins objects based on privilege 2 and states: “All non-privileged information about the Data Breach is included in the December 3 2021 Notice of Data Breach.”). As such, while it is true that Stroz Friedberg was retained by

4 counsel, the similarities to the Target case end there. It is well-established that mere delegation of 5 business functions to an attorney is insufficient to shield otherwise unprotected factual 6 investigation from discovery. See Guo Wengui, 338 F.R.D. at 13 (collecting cases); see also Allied 7 Irish Banks v. Bank of Am., N.A., 240 F.R.D. 96, 99 (S.D.N.Y. 2007) (“That [the plaintiff] hired a 8 law firm to ‘assist’ in the investigation is of no moment.... A party may not insulate itself from 9 discovery by hiring an attorney to conduct an investigation that otherwise would not be accorded 10 work product protection.”) (cleaned up). 11 McMenamins also relies on In re Experian Data Breach Litig., 2017 WL 4325583. There, 12 Experian retained Jones Day as legal counsel and Jones Day in turn hired the cybersecurity

13 consultant to help “provide legal advice to Experian regarding the attack.” Id. at *2. The court 14 denied Plaintiff’s motion to compel the consultant’s report, finding the report was relevant to the 15 defense of the litigation and not an internal investigation or remediation because the report was 16 not provided to Experian’s internal incident response team. Id. Here, as noted above, the Stroz 17 Friedberg report is the only internal investigation arising from the data breach at McMenamins and 18 the report itself acknowledges Stroz Friedberg participated in many internal business discussions. 19 The Court finds Guo Wengui more closely resembles the facts of this case. 338 F.R.D. 7. 20 In that case, like here, the hacked entity (a law firm) failed to demonstrate that any meaningful 21 investigation of the data breach occurred apart from the lone consultant report at issue. The court 22 also noted that the report was shared with leadership and IT, just like the report here. The court

23 recognized that the consultant was hired by counsel but found “that approach ‘appears to [have 24 been] designed to help shield material from disclosure.’” Guo Wengui, 338 F.R.D. at 13 (quoting 1 In re Dominion Dental Servs. USA Data Breach Litig., 429 F. Supp. 3d 190, 195 (E.D. Va. 2019)). 2 Other courts granting motions to compel cybersecurity reports also focus on the description of 3 services in the scope of work and the availability of factual information from other non-privileged

4 sources. See, e.g., In re Premera Blue Cross Customer Data Sec. Breach Litig., 296 F. Supp. 3d 5 1230, 1245–46 (D. Or. 2017); Dominion Dental Servs., 429 F. Supp. 3d 190; In re Cap. One 6 Consumer Data Sec. Breach Litig., MDL No. 1:19md2915 (AJT/JFA), 2020 WL 2731238 (E.D. 7 Va. May 26, 2020). 8 In light of the above persuasive authority and the Court’s in camera review of the report, 9 the Court finds that the Stroz Friedberg report is not protected work product. In short, the report 10 provides only factual information. Stroz Friedberg was hired to determine the timing, means, and 11 extent of the data breach while also participating in containment and restoration processes. The 12 report also notes that Stroz Friedberg contributed to business discussions and provided remediation

13 and investigative services. Further, the supplemental scope of work underscores that Stroz 14 Friedberg was assisting with restoration services, not providing legal advice. Beyond the 15 conclusory and self-serving first sentence of the report that Stroz Friedberg was engaged to assist 16 in providing legal advice, there is no evidence this report was in fact used to provide legal advice. 17 Instead, the report, engagement letter, scopes of work, and all other available evidence demonstrate 18 that Stroz Friedberg drafted this report for a business purpose, unrelated to anticipated or pending 19 litigation. The report is not work product. 20 Moreover, even if the report could be considered work product, Plaintiffs have 21 demonstrated a “substantial need for the materials to prepare its case and cannot, without undue 22 hardship, obtain their substantial equivalent by other means.” Fed. R. Civ. P. 26(b)(3)(A). As

23 detailed above, the Stroz Friedberg report is the only available information about how the data 24 breach occurred and what remedial efforts McMenamins undertook in response to it. At oral 1 argument, McMenamins argued that the publicly available notice of data breach included the same 2 information as the report, and constituted the entirety of non-privileged facts to which Plaintiffs 3 are entitled. McMenamins’ position is nonsensical. The report includes more than a dozen pages

4 of highly technical and detailed information while the notice includes, at most, a dozen vague 5 sentences. As such, even if the report was work product, Rule 26(b)(3)(A) compels its production. 6 b. The Stroz Friedberg report is not attorney-client privileged. McMenamins also claims that the Stroz Friedberg report is protected under the attorney- 7 client privilege. In the Ninth Circuit, communications are protected by the attorney-client privilege 8 when the following eight elements are satisfied: “(1) Where legal advice of any kind is sought (2) 9 from a professional legal adviser in his capacity as such, (3) the communications relating to that 10 purpose, (4) made in confidence (5) by the client, (6) are at his instance permanently protected (7) 11 from disclosure by himself or by the legal adviser, (8) unless the protection be waived.” United 12 States v. Ruehle, 583 F.3d 600, 607 (9th Cir. 2009). “[T]he attorney-client privilege is strictly 13 construed.” Id. 14 McMenamins argues the Stroz Friedberg report is attorney-client privileged because it was 15 “created at the request of counsel, by a third party engaged to assist in the provision of legal advice” 16 and “the report notes that it is confidential and privileged.” Dkt. No. 42 at 14. This argument 17 ignores the first factor: whether legal advice was sought. For the same reasons the report is not 18 work product, it also fails to be attorney-client privileged: the report does not provide legal advice. 19 Moreover, McMenamins’ privilege log does not identify attachments to allegedly privileged 20 communications, so the Court is unable to confirm to what extent it was shared among 21 McMenamins employees and others, or whether the report was, in fact, kept confidential and 22 privileged. 23 In sum, McMenamins must produce a full copy of the report. 24 1 c. Entries on the privilege log that include Stroz Friedberg are generally not attorney-client privileged and must be produced. 2 McMenamins has apparently withheld in full all communications between any 3 McMenamins employees and Stroz Friedberg personnel. No such communications have been 4 produced, and McMenamins’ privilege log categorizes communications involving its employees, 5 counsel, and Stroz Friedberg as attorney-client privileged. Dkt. No. 48 at 124–139 (excerpt 6 identifying communications that include Stroz Friedberg). McMenamins’ response to the motion 7 to compel does not address these communications explicitly but rather argues generally that “the 8 information related to [the] Stroz Friedberg report” is attorney-client privileged. Dkt. No. 42 at 9 14. McMenamins does not argue the communications are protected work product. 10 To be attorney-client privileged, the communications with employees, counsel, and Stroz 11 Friedberg must be related to legal advice. Ruehle, 583 F.3d at 607. There can be circumstances 12 when a cybersecurity consultant works with counsel to provide legal advice after a data breach. 13 See Premera, 296 F. Supp. 3d at 1246 (“[G]iven Mandiant’s role in working with outside counsel, 14 there may be some privileged communications or work-product protected information in the 15 withheld documents.”). However, neither the engagement letter nor the scope of work identifies 16 any work by Stroz Friedberg related to the provision of legal advice. The evidence demonstrates 17 Stroz Friedberg was providing a business service, by seeking and providing factual information to 18 McMenamins and their counsel. And factual information contained in an email is not protected 19 merely because an attorney was copied. See Newman v. Highland Sch. Dist. No. 203, 381 P.3d 20 1188, 1191 (Wash. 2016) (“The attorney-client privilege does not shield facts from discovery, 21 even if transmitted in communications between attorney and client.”). Thus, communications 22 involving Stroz Friedberg concerning the facts of the attack and McMenamins’ response, 23 investigation(s), and remediation are not privileged. McMenamins must revise its privilege log to 24 1 remove, and produce, any such communications.7 To the extent any communications containing 2 factual material also include legal advice, redacted versions must be produced and the justification 3 for said redactions detailed on McMenamins’ revised privilege log. 4 2. McMenamins must supplement its responses to Plaintiffs’ first set of interrogatories and RFPs. 5 In accordance with the Court’s ruling that the Stroz Friedberg report and related factual 6 information and communications are not privileged, McMenamins must supplement its responses 7 to Plaintiffs’ first set of interrogatories and RFPs to include any information or documents that 8 were withheld on privilege grounds in a manner inconsistent with this order. See Dkt. No. 40 at 9 47–53, 69–90. These updated answers and responses must comply with the Federal Rules of Civil 10 Procedure. Specifically, McMenamins cannot incorporate objections and responses by reference, 11 as such answers make it impossible to determine how each objection relates to any given request. 12 Interrogatories must “be answered separately and fully.” Fed. R. Civ. P. 33(b)(3). Any objections 13 to interrogatories “must be stated with specificity.” Fed. R. Civ. P. 33(b)(4). Likewise, any 14 objection to a request for production “must state whether any responsive materials are being 15 withheld on the basis of that objection.” Fed. R. Civ. P. 34(b)(2)(B), (C). 16 B. Plaintiffs’ Second Motion to Compel is Granted in Part and Denied in Part. 17 Plaintiffs’ second motion seeks an order compelling McMenamins to produce documents 18 responsive to RFPs 42–56, and 59. Dkt. No. 49. Plaintiffs argue the financial documents they 19 seek in these RFPs are relevant (1) to prove McMenamins’ negligence, breach of fiduciary duties, 20 and violation of the CPA; (2) for a punitive damages analysis under the CPA; and (3) to enable 21 Plaintiffs to make a realistic appraisal of the case. Id. McMenamins argues in response to 22 23

7 The Court expects most, if not all, communications that include Stroz Friedberg will be removed from the privilege 24 log and produced. 1 Plaintiffs’ motion that because it had already agreed to “produce documents related to its financial 2 investments in cybersecurity,” the remaining requests are irrelevant and overbroad. Dkt. No. 53. 3 As a threshold matter, McMenamins’ discovery responses only objected to the requests at

4 issue based on relevance, and not on overbreadth or burden, the grounds McMenamins argues 5 now. See Dkt. No. 50 at 30–34.8 Those objections may not be raised for the first time in this 6 posture. See Richmark Corp. v. Timber Falling Consultants, 959 F.2d 1468, 1473 (9th Cir. 1992) 7 (“It is well established that a failure to object to discovery requests within the time required 8 constitutes a waiver of any objection.”); O. L. v. City of El Monte, Case No. 2:20-cv-0797 RGK 9 (JDEx), 2021 WL 926105, at *3 (C.D. Cal. Jan. 11, 2021) (“[O]bjections not raised in a written 10 response to discovery may not be raised for the first time in a discovery motion.”). Accordingly, 11 while the Court agrees that many of the requests appear overly broad, because McMenamins 12 limited its objections to relevance, the Court will likewise limit its evaluation of the requests to 13 relevance grounds. 14 The bar for relevance in civil discovery is low. See Fed. R. Civ. P. 26(a)(b)(1). Plaintiffs 15 argue that the requests are relevant to prove McMenamins’ liability for their substantive claims, 16 by showing that McMenamins allegedly breached various duties to “adequately fund cybersecurity 17 protections given the financial resources available to it, and in light of its decisions to allocate 18 funding for other purposes.” Dkt. No. 49 at 5. McMenamins’ offer to provide documents only 19 related to financial investments in cybersecurity would presumably not reach records documenting 20 choices in favor of other expenditures. Plaintiffs additionally argue that their requests are relevant 21 to showing their entitlement to treble damages under the CPA and for case assessment purposes. 22 8 McMenamins also objected to various requests as “unreasonably duplicative” of other requests and incorporated by 23 reference their previously stated objections. See e.g., Dkt. No. 50 at 32, 33. However, the “incorporated” objections state only relevance. Id. Moreover, for each request, McMenamins also said it would produce nonprivileged, responsive documents. However, it is impossible to know for each request whether any such documents have been or 24 will be produced, what might be withheld, and on what basis. Dkt. No. 50 at 30–34. 1 Given the generous standard for relevance in civil discovery, and McMenamins’ meager 2 objections, the Court finds that Plaintiffs have met their burden of showing that the following 3 requests seek information relevant to their claims: RFPs 42, 43, 44, 46, 48, 51, 52, 53, 54, 55, and

4 56. Plaintiffs’ motion to compel is thus granted for these requests. By contrast, Plaintiffs have 5 failed to show how RFPs 45 (“all records indicating any and all sales”), 47 (“copies of all form 6 1099s”), 49 (“all bank statements for all bank accounts”), 50 (“copies of all records, bills and 7 invoices pertaining to the expenses and gross receipts” of Defendant going back to 2017), and 59 8 (“[d]ocuments sufficient to show the ownership … of Defendant”) seek information that is relevant 9 to their claims and that they would not otherwise obtain from answers to other requests. 10 Accordingly, Plaintiffs’ second motion to compel is granted in part and denied in part. 11 McMenamins must produce all nonprivileged documents responsive to the RFPs identified above. 12 IV. CONCLUSION For these reasons, the Court GRANTS Plaintiffs’ first motion to compel (Dkt. No. 39) and 13 GRANTS IN PART AND DENIES IN PART Plaintiffs’ second motion to compel (Dkt. No. 49). 14 McMenamins is ORDERED to: 15 (1) produce a full copy of the Stroz Friedberg report, engagement letter, and all scopes of 16 work by December 13, 2023; 17 (2) reproduce its privilege log by January 5, 2024; 18 (3) update its responses to Plaintiffs’ first set of discovery by January 5, 2024, and 19 (4) produce all nonprivileged, responsive documents to RFPs 42, 43, 44, 46, 48, 51, 52, 53, 20 54, 55, and 56 by January 5, 2024. 21 Dated this 6th day of December, 2023. 22 A 23 Kymberly K. Evanson 24 United States District Judge