Loading
Insurance
7 min read
Areas of Expertise :
Cybersecurity, Digital Forensics, Computer Forensics, Data Breach, Data Security, Data Privacy, Computer Networks
Published Date:
Last Modified Date:
Jurisdiction:
Federal. Fourth Circuit
In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019), involved claims arising from unauthorized access to computer systems maintained by Dominion National, an insurer and administrator of dental and vision benefits. Dominion discovered the intrusion in April 2019 and later reported that unauthorized access may have begun as early as August 25, 2010. The litigation addressed the potential exposure of personal information, Dominion's security practices, and its response after the intrusion was identified.
A central discovery dispute concerned a forensic report prepared by FireEye Mandiant. Dominion maintained that the report had been prepared to assist counsel with anticipated litigation and was therefore protected under the work-product doctrine. The U.S. District Court for the Eastern District of Virginia disagreed, finding that Dominion had not shown that Mandiant's report would have been materially different if litigation had not been anticipated. The broader class action ultimately ended through a settlement that received final approval in November 2021.
Dominion National later reported that unauthorized access to its systems may have started as early as August 25, 2010. Plaintiffs alleged that attackers had access to Dominion databases over an extended period, potentially exposing personal and financial information associated with dental and vision benefit plans. The alleged length of the intrusion became relevant to questions about what systems were affected, what information may have been accessible, and what evidence remained available by the time the breach was discovered.
The court found that the defendants' relationship with Mandiant existed no later than August 1, 2016, several years before Dominion discovered the intrusion. The court identified a master services agreement dated August 1, 2016 involving Capital BlueCross, Mandiant, and BakerHostetler LLP.
That earlier relationship later became significant in the work-product dispute. In deciding whether Mandiant's post-breach report had been created because of anticipated litigation, the court considered whether the company had already been expected to provide similar cybersecurity and incident-response services before the breach was discovered.
On June 19, 2018, the defendants, Mandiant, and BakerHostetler LLP entered into a statement of work that predated Dominion's discovery of the intrusion. The arrangement covered computer incident-response support, digital forensics, advanced threat-actor assistance, and related cybersecurity services.
Expected deliverables included status reporting, a final incident-response report containing recommendations, and an executive briefing. Those provisions later gave the court a concrete basis for comparing the work contemplated before the discovered breach with the investigation Mandiant performed afterward.
Dominion received an internal security alert on April 17, 2019 indicating potentially suspicious activity. Following an investigation, the company determined on April 24 that an unauthorized party may have accessed certain servers.
Dominion cleaned affected systems, strengthened its monitoring and alerting capabilities, contacted the FBI, and continued investigating the intrusion. Around April 24 or April 25, BakerHostetler entered into another statement of work with Mandiant for the benefit of Capital BlueCross. That arrangement incorporated aspects of the existing relationship and covered Mandiant's investigation of the newly discovered incident.
Mandiant concluded its investigation on May 17, 2019 after reviewing affected systems and unauthorized activity. Its work addressed the nature and scope of the intrusion and generated information that Dominion used while responding to the incident.
The materials produced through that investigation later became a significant discovery issue. Plaintiffs sought access to Mandiant's findings, while Dominion argued that the investigation had been conducted in anticipation of litigation and that the resulting materials should therefore remain protected.
Dominion disclosed the security incident on June 21, 2019. The company stated that the information potentially accessible through affected systems varied by individual and could include enrollment and demographic information associated with dental and vision benefits, as well as identifying and financial information.
Dominion also stated that it had not found evidence showing that the information had actually been accessed, acquired, or misused. Lawsuits followed based on the alleged exposure of personal information and Dominion's handling of the incident.
Mandiant delivered its final forensic report on August 19, 2019. The report summarized findings from the investigation of the unauthorized access and affected systems.
During the later discovery dispute, the court found that information developed through Mandiant's investigation had been used in communications involving Dominion clients. The court also observed that the defendants appeared to have used investigative information in communications with state regulators, although it noted that the record was not entirely clear on that issue.
These uses became relevant because the court was not considering the report's label alone. It examined how the investigation operated in practice, what services had been contemplated before litigation was anticipated, and how the resulting information was used after the incident.
Plaintiffs moved to compel production of the Mandiant report and related materials. Dominion opposed production based on attorney-client privilege and the work-product doctrine.
U.S. Magistrate Judge Michael S. Nachmanoff granted the motion to compel. The court compared Mandiant's pre-breach and post-breach engagements and found substantial similarities in both the services to be performed and the expected deliverables.
The comparison was central to the court's analysis. Mandiant had already been retained for incident-response and digital-forensics services before Dominion identified the breach. Dominion did not establish that the final report would have taken a materially different form if litigation had not been anticipated. The court therefore concluded that Dominion had not met its burden of showing that the report qualified for work-product protection.
The district court later considered motions to dismiss involving Article III standing and the sufficiency of claims related to the breach. U.S. District Judge Leonie M. Brinkema determined that Magdalyne Hilliard and Sayed Abubaker had alleged sufficient facts to establish standing at that stage of the litigation.
Other plaintiffs and related actions were dismissed without prejudice for lack of standing as specified in the court's ruling. The remaining plaintiffs were directed to proceed through a streamlined amended complaint.
On February 18, 2020, the district court stayed further proceedings while appeals involving its standing rulings were pending. The court also entered final judgment under Federal Rule of Civil Procedure 54(b) as to certain dismissed plaintiffs.
The stay paused substantive district court proceedings while the appellate matters continued. The litigation eventually moved toward a negotiated class settlement rather than a trial on the underlying data-security claims.
The court granted preliminary approval of the proposed class settlement on May 20, 2021. Qualifying class members could seek up to $300 for ordinary losses and lost time, including up to $100 attributable to lost time. The settlement also permitted claims of up to $7,500 per person for qualifying extraordinary losses related to the incident.
Aggregate compensation for qualifying ordinary and extraordinary loss claims was capped at $2 million. If approved claims exceeded the available amount, eligible payments could be reduced proportionally.
The agreement also required additional information-security measures that Dominion National estimated were worth approximately $2.68 million.
U.S. District Judge Leonie M. Brinkema granted final approval of the class settlement on November 19, 2021. Final judgment resolved the released claims and dismissed the litigation in accordance with the settlement agreement.
Related appellate proceedings were voluntarily dismissed, and the Fourth Circuit issued its dismissal and mandate on December 21, 2021, bringing the federal litigation to a close.
Court:
United States District Court for the Eastern District of Virginia
Case Name:
In re: Dominion Dental Services USA, Inc. Data Breach Litigation
Dominion National discovered unauthorized system access in April 2019, with the intrusion potentially dating back to August 2010.
The litigation involved alleged exposure of personal and financial information, cybersecurity practices, and the company's incident response.
A central discovery dispute concerned whether Mandiant's forensic investigation report was protected under the work-product doctrine.
In 2019, the court ordered production of the report, finding that Dominion had not established that the investigation materially differed from previously contracted cybersecurity services.
The litigation ended in a 2021 class settlement with up to $2 million for qualifying loss claims and approximately $2.68 million in additional security measures.
Information Security
Computer Security
Digital Evidence
Computer Systems
Data Networks
Identity Theft
Encryption
Risk Assessment
In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019), involved claims arising from unauthorized access to computer systems maintained by Dominion National, an insurer and administrator of dental and vision benefits. Dominion discovered the intrusion in April 2019 and later reported that unauthorized access may have begun as early as August 25, 2010. The litigation addressed the potential exposure of personal information, Dominion's security practices, and its response after the intrusion was identified.
A central discovery dispute concerned a forensic report prepared by FireEye Mandiant. Dominion maintained that the report had been prepared to assist counsel with anticipated litigation and was therefore protected under the work-product doctrine. The U.S. District Court for the Eastern District of Virginia disagreed, finding that Dominion had not shown that Mandiant's report would have been materially different if litigation had not been anticipated. The broader class action ultimately ended through a settlement that received final approval in November 2021.
Dominion National later reported that unauthorized access to its systems may have started as early as August 25, 2010. Plaintiffs alleged that attackers had access to Dominion databases over an extended period, potentially exposing personal and financial information associated with dental and vision benefit plans. The alleged length of the intrusion became relevant to questions about what systems were affected, what information may have been accessible, and what evidence remained available by the time the breach was discovered.
The court found that the defendants' relationship with Mandiant existed no later than August 1, 2016, several years before Dominion discovered the intrusion. The court identified a master services agreement dated August 1, 2016 involving Capital BlueCross, Mandiant, and BakerHostetler LLP.
That earlier relationship later became significant in the work-product dispute. In deciding whether Mandiant's post-breach report had been created because of anticipated litigation, the court considered whether the company had already been expected to provide similar cybersecurity and incident-response services before the breach was discovered.
On June 19, 2018, the defendants, Mandiant, and BakerHostetler LLP entered into a statement of work that predated Dominion's discovery of the intrusion. The arrangement covered computer incident-response support, digital forensics, advanced threat-actor assistance, and related cybersecurity services.
Expected deliverables included status reporting, a final incident-response report containing recommendations, and an executive briefing. Those provisions later gave the court a concrete basis for comparing the work contemplated before the discovered breach with the investigation Mandiant performed afterward.
Dominion received an internal security alert on April 17, 2019 indicating potentially suspicious activity. Following an investigation, the company determined on April 24 that an unauthorized party may have accessed certain servers.
Dominion cleaned affected systems, strengthened its monitoring and alerting capabilities, contacted the FBI, and continued investigating the intrusion. Around April 24 or April 25, BakerHostetler entered into another statement of work with Mandiant for the benefit of Capital BlueCross. That arrangement incorporated aspects of the existing relationship and covered Mandiant's investigation of the newly discovered incident.
Mandiant concluded its investigation on May 17, 2019 after reviewing affected systems and unauthorized activity. Its work addressed the nature and scope of the intrusion and generated information that Dominion used while responding to the incident.
The materials produced through that investigation later became a significant discovery issue. Plaintiffs sought access to Mandiant's findings, while Dominion argued that the investigation had been conducted in anticipation of litigation and that the resulting materials should therefore remain protected.
Dominion disclosed the security incident on June 21, 2019. The company stated that the information potentially accessible through affected systems varied by individual and could include enrollment and demographic information associated with dental and vision benefits, as well as identifying and financial information.
Dominion also stated that it had not found evidence showing that the information had actually been accessed, acquired, or misused. Lawsuits followed based on the alleged exposure of personal information and Dominion's handling of the incident.
Mandiant delivered its final forensic report on August 19, 2019. The report summarized findings from the investigation of the unauthorized access and affected systems.
During the later discovery dispute, the court found that information developed through Mandiant's investigation had been used in communications involving Dominion clients. The court also observed that the defendants appeared to have used investigative information in communications with state regulators, although it noted that the record was not entirely clear on that issue.
These uses became relevant because the court was not considering the report's label alone. It examined how the investigation operated in practice, what services had been contemplated before litigation was anticipated, and how the resulting information was used after the incident.
Plaintiffs moved to compel production of the Mandiant report and related materials. Dominion opposed production based on attorney-client privilege and the work-product doctrine.
U.S. Magistrate Judge Michael S. Nachmanoff granted the motion to compel. The court compared Mandiant's pre-breach and post-breach engagements and found substantial similarities in both the services to be performed and the expected deliverables.
The comparison was central to the court's analysis. Mandiant had already been retained for incident-response and digital-forensics services before Dominion identified the breach. Dominion did not establish that the final report would have taken a materially different form if litigation had not been anticipated. The court therefore concluded that Dominion had not met its burden of showing that the report qualified for work-product protection.
The district court later considered motions to dismiss involving Article III standing and the sufficiency of claims related to the breach. U.S. District Judge Leonie M. Brinkema determined that Magdalyne Hilliard and Sayed Abubaker had alleged sufficient facts to establish standing at that stage of the litigation.
Other plaintiffs and related actions were dismissed without prejudice for lack of standing as specified in the court's ruling. The remaining plaintiffs were directed to proceed through a streamlined amended complaint.
On February 18, 2020, the district court stayed further proceedings while appeals involving its standing rulings were pending. The court also entered final judgment under Federal Rule of Civil Procedure 54(b) as to certain dismissed plaintiffs.
The stay paused substantive district court proceedings while the appellate matters continued. The litigation eventually moved toward a negotiated class settlement rather than a trial on the underlying data-security claims.
The court granted preliminary approval of the proposed class settlement on May 20, 2021. Qualifying class members could seek up to $300 for ordinary losses and lost time, including up to $100 attributable to lost time. The settlement also permitted claims of up to $7,500 per person for qualifying extraordinary losses related to the incident.
Aggregate compensation for qualifying ordinary and extraordinary loss claims was capped at $2 million. If approved claims exceeded the available amount, eligible payments could be reduced proportionally.
The agreement also required additional information-security measures that Dominion National estimated were worth approximately $2.68 million.
U.S. District Judge Leonie M. Brinkema granted final approval of the class settlement on November 19, 2021. Final judgment resolved the released claims and dismissed the litigation in accordance with the settlement agreement.
Related appellate proceedings were voluntarily dismissed, and the Fourth Circuit issued its dismissal and mandate on December 21, 2021, bringing the federal litigation to a close.
Digital Forensics Expert Witness
A digital forensics expert may address one of the most difficult technical questions raised by an alleged intrusion lasting several years: reconstructing historical activity after substantial time has passed. Relevant work could include analyzing system logs, account records, network artifacts, archived information, and gaps created by ordinary data-retention practices.
In a dispute involving facts similar to Dominion's, this expertise could help determine when unauthorized activity occurred, which systems were affected, whether particular information was accessible, and what conclusions can reasonably be drawn from incomplete historical evidence.
Cybersecurity Expert Witness
A cybersecurity expert can analyze the technical and organizational measures used to detect, contain, investigate, and respond to unauthorized access. In the Dominion matter, relevant issues could include the April 2019 security alert, monitoring systems, access controls, containment efforts, system remediation, security improvements, and coordination with outside cybersecurity professionals.
This expertise may also help assess whether the organization's cybersecurity practices and response measures were consistent with the systems, risks, and circumstances involved in the incident. The expert could also address the technical scope of Mandiant's work and how its investigation related to Dominion's broader cybersecurity response.
Network Security Expert Witness
A network security expert can assess the technical controls surrounding the systems involved in an intrusion. The analysis may cover authentication, network architecture, access controls, segmentation, monitoring tools, security alerts, and methods available to detect or restrict unauthorized activity.
For an incident allegedly extending over many years, the expert may also consider how systems and controls changed over time and whether available technical evidence can show how an unauthorized user entered or moved through the network.
Information Security Expert Witness
An information security governance expert can address broader organizational controls rather than focusing only on individual network events. Relevant subjects may include vulnerability management, security policies, risk assessments, incident-response planning, monitoring responsibilities, vendor relationships, and safeguards for sensitive personal information.
In a case involving a pre-existing cybersecurity vendor relationship, governance evidence can also help explain how outside incident-response services fit within the organization's ordinary security program before a specific breach was discovered.
Data Privacy and Security Compliance Expert Witness
A data privacy and security compliance expert can analyze how an organization handled personal and financial information before and after a security incident. The work may include breach-response procedures, notification obligations, recordkeeping practices, security governance, and the handling of information generated during an investigation.
This expertise is particularly relevant where investigative findings are later communicated to clients, regulators, or other parties because those communications can intersect with legal, regulatory, and discovery issues.
Attorney Involvement Does Not Automatically Protect a Forensic Report
The presence of outside counsel does not by itself determine whether a cybersecurity report is protected by the work-product doctrine. Courts can examine the actual purpose of the investigation, the scope of work performed, and whether materially similar work would have occurred without anticipated litigation.
That distinction drove the dispute in Dominion Dental. Rather than relying only on the fact that counsel participated in Mandiant's engagement, the court examined what Mandiant had already been retained to do and compared those services with the investigation conducted after the breach was identified.
Pre-Breach Vendor Agreements Can Become Critical Evidence
Existing cybersecurity contracts can provide important evidence when a party later argues that a post-breach investigation was undertaken primarily because of anticipated litigation.
In Dominion Dental, the June 2018 statement of work contemplated incident response, digital forensics, status reporting, a final report, recommendations, and an executive briefing before the intrusion had been discovered. The court compared that arrangement with Mandiant's later work and found substantial similarities.
The case therefore illustrates how the language and scope of pre-incident vendor agreements can become central to a later discovery dispute.
Courts May Look at How Investigation Findings Were Actually Used
The practical use of forensic findings may matter when a court considers whether investigative materials should remain protected from discovery.
In this litigation, information generated through Mandiant's investigation was used in communications involving Dominion clients. The court also observed that investigative information appeared to have been used in communications with state regulators, although the record was not completely clear on that point.
Those circumstances formed part of a broader factual analysis of why the investigation was conducted and how its results functioned outside the litigation process.
Long-Term Intrusions Can Complicate Digital Reconstruction
Dominion reported that unauthorized access may have begun years before the company detected the breach. An investigation covering such an extended period can create substantial forensic challenges because historical logs may no longer exist, systems may have changed, accounts may have been modified, and routine retention policies may have removed potentially relevant evidence.
The Dominion incident illustrates why investigators may need to reconstruct older activity from multiple forms of evidence rather than relying on a complete historical record from a single source.
Data Breach Resolutions Can Combine Compensation With Security Changes
The Dominion settlement addressed more than reimbursement for claimed losses. Qualifying class members could seek compensation for certain ordinary and extraordinary losses, while the agreement also required additional information-security measures.
Aggregate payments for qualifying ordinary and extraordinary loss claims were capped at $2 million. Dominion National separately estimated the value of the additional security measures at approximately $2.68 million.
The resolution illustrates how a cybersecurity class settlement can address both claimed financial harm and future information-security practices without resolving the underlying security allegations through a trial.
In re Dominion Dental Services USA, Inc. Data Breach Litigation combined an alleged long-term system intrusion with a significant discovery dispute over the status of a post-breach forensic investigation. The December 2019 ruling focused closely on Mandiant's work before and after the breach was discovered. Because substantially similar incident-response and forensic services had already been contemplated before the anticipated litigation, Dominion did not establish that the final report was protected under the work-product doctrine.
The underlying data-breach claims were never resolved through a trial on the merits. Instead, the litigation concluded through a class settlement that provided compensation for qualifying losses and additional information-security measures. Final approval and judgment were entered on November 19, 2021, followed by the voluntary dismissal of the related appellate proceedings in December 2021.
What happened after Dominion National received the April 2019 security alert?
Dominion investigated the April 17, 2019 alert and determined on April 24 that an unauthorized party may have accessed certain servers. The company cleaned affected systems, strengthened monitoring and alerting capabilities, contacted the FBI, and continued investigating the incident with Mandiant.
When may unauthorized access to Dominion National's systems have started?
Dominion National reported that unauthorized access may have begun as early as August 25, 2010. The intrusion was not discovered until April 2019, creating an unusually long period for investigators to consider when reconstructing what occurred within the affected systems.
What role did Mandiant play in the Dominion National data breach investigation?
Mandiant conducted the technical investigation into the unauthorized access and prepared the final forensic report. Its work involved examining affected systems and analyzing the nature and scope of the intrusion, but its pre-existing relationship with the defendants later became central to the dispute over whether the final report qualified for work-product protection.
What information may have been affected by the Dominion National data breach?
Potentially affected information varied by individual and could include names, addresses, email addresses, dates of birth, Social Security numbers, taxpayer identification numbers, member information, enrollment records, and certain bank account or routing information. Dominion stated that it had not found evidence showing that the information had actually been accessed, acquired, or misused.
Why did Mandiant's pre-breach cybersecurity agreement matter to the court?
Digital Forensics Expert Witness
A digital forensics expert may address one of the most difficult technical questions raised by an alleged intrusion lasting several years: reconstructing historical activity after substantial time has passed. Relevant work could include analyzing system logs, account records, network artifacts, archived information, and gaps created by ordinary data-retention practices.
In a dispute involving facts similar to Dominion's, this expertise could help determine when unauthorized activity occurred, which systems were affected, whether particular information was accessible, and what conclusions can reasonably be drawn from incomplete historical evidence.
Cybersecurity Expert Witness
A cybersecurity expert can analyze the technical and organizational measures used to detect, contain, investigate, and respond to unauthorized access. In the Dominion matter, relevant issues could include the April 2019 security alert, monitoring systems, access controls, containment efforts, system remediation, security improvements, and coordination with outside cybersecurity professionals.
This expertise may also help assess whether the organization's cybersecurity practices and response measures were consistent with the systems, risks, and circumstances involved in the incident. The expert could also address the technical scope of Mandiant's work and how its investigation related to Dominion's broader cybersecurity response.
Network Security Expert Witness
A network security expert can assess the technical controls surrounding the systems involved in an intrusion. The analysis may cover authentication, network architecture, access controls, segmentation, monitoring tools, security alerts, and methods available to detect or restrict unauthorized activity.
For an incident allegedly extending over many years, the expert may also consider how systems and controls changed over time and whether available technical evidence can show how an unauthorized user entered or moved through the network.
Information Security Expert Witness
An information security governance expert can address broader organizational controls rather than focusing only on individual network events. Relevant subjects may include vulnerability management, security policies, risk assessments, incident-response planning, monitoring responsibilities, vendor relationships, and safeguards for sensitive personal information.
In a case involving a pre-existing cybersecurity vendor relationship, governance evidence can also help explain how outside incident-response services fit within the organization's ordinary security program before a specific breach was discovered.
Data Privacy and Security Compliance Expert Witness
A data privacy and security compliance expert can analyze how an organization handled personal and financial information before and after a security incident. The work may include breach-response procedures, notification obligations, recordkeeping practices, security governance, and the handling of information generated during an investigation.
This expertise is particularly relevant where investigative findings are later communicated to clients, regulators, or other parties because those communications can intersect with legal, regulatory, and discovery issues.
Attorney Involvement Does Not Automatically Protect a Forensic Report
The presence of outside counsel does not by itself determine whether a cybersecurity report is protected by the work-product doctrine. Courts can examine the actual purpose of the investigation, the scope of work performed, and whether materially similar work would have occurred without anticipated litigation.
That distinction drove the dispute in Dominion Dental. Rather than relying only on the fact that counsel participated in Mandiant's engagement, the court examined what Mandiant had already been retained to do and compared those services with the investigation conducted after the breach was identified.
Pre-Breach Vendor Agreements Can Become Critical Evidence
Existing cybersecurity contracts can provide important evidence when a party later argues that a post-breach investigation was undertaken primarily because of anticipated litigation.
In Dominion Dental, the June 2018 statement of work contemplated incident response, digital forensics, status reporting, a final report, recommendations, and an executive briefing before the intrusion had been discovered. The court compared that arrangement with Mandiant's later work and found substantial similarities.
The case therefore illustrates how the language and scope of pre-incident vendor agreements can become central to a later discovery dispute.
Courts May Look at How Investigation Findings Were Actually Used
The practical use of forensic findings may matter when a court considers whether investigative materials should remain protected from discovery.
In this litigation, information generated through Mandiant's investigation was used in communications involving Dominion clients. The court also observed that investigative information appeared to have been used in communications with state regulators, although the record was not completely clear on that point.
Those circumstances formed part of a broader factual analysis of why the investigation was conducted and how its results functioned outside the litigation process.
Long-Term Intrusions Can Complicate Digital Reconstruction
Dominion reported that unauthorized access may have begun years before the company detected the breach. An investigation covering such an extended period can create substantial forensic challenges because historical logs may no longer exist, systems may have changed, accounts may have been modified, and routine retention policies may have removed potentially relevant evidence.
The Dominion incident illustrates why investigators may need to reconstruct older activity from multiple forms of evidence rather than relying on a complete historical record from a single source.
Data Breach Resolutions Can Combine Compensation With Security Changes
The Dominion settlement addressed more than reimbursement for claimed losses. Qualifying class members could seek compensation for certain ordinary and extraordinary losses, while the agreement also required additional information-security measures.
Aggregate payments for qualifying ordinary and extraordinary loss claims were capped at $2 million. Dominion National separately estimated the value of the additional security measures at approximately $2.68 million.
The resolution illustrates how a cybersecurity class settlement can address both claimed financial harm and future information-security practices without resolving the underlying security allegations through a trial.
In re Dominion Dental Services USA, Inc. Data Breach Litigation combined an alleged long-term system intrusion with a significant discovery dispute over the status of a post-breach forensic investigation. The December 2019 ruling focused closely on Mandiant's work before and after the breach was discovered. Because substantially similar incident-response and forensic services had already been contemplated before the anticipated litigation, Dominion did not establish that the final report was protected under the work-product doctrine.
The underlying data-breach claims were never resolved through a trial on the merits. Instead, the litigation concluded through a class settlement that provided compensation for qualifying losses and additional information-security measures. Final approval and judgment were entered on November 19, 2021, followed by the voluntary dismissal of the related appellate proceedings in December 2021.
What happened after Dominion National received the April 2019 security alert?
Dominion investigated the April 17, 2019 alert and determined on April 24 that an unauthorized party may have accessed certain servers. The company cleaned affected systems, strengthened monitoring and alerting capabilities, contacted the FBI, and continued investigating the incident with Mandiant.
When may unauthorized access to Dominion National's systems have started?
Dominion National reported that unauthorized access may have begun as early as August 25, 2010. The intrusion was not discovered until April 2019, creating an unusually long period for investigators to consider when reconstructing what occurred within the affected systems.
What role did Mandiant play in the Dominion National data breach investigation?
Mandiant conducted the technical investigation into the unauthorized access and prepared the final forensic report. Its work involved examining affected systems and analyzing the nature and scope of the intrusion, but its pre-existing relationship with the defendants later became central to the dispute over whether the final report qualified for work-product protection.
What information may have been affected by the Dominion National data breach?
Potentially affected information varied by individual and could include names, addresses, email addresses, dates of birth, Social Security numbers, taxpayer identification numbers, member information, enrollment records, and certain bank account or routing information. Dominion stated that it had not found evidence showing that the information had actually been accessed, acquired, or misused.
Why did Mandiant's pre-breach cybersecurity agreement matter to the court?
The pre-breach agreement mattered because it showed that Mandiant had already been expected to provide incident-response and forensic services before Dominion discovered the intrusion. When the court compared that work with Mandiant's post-breach investigation, it found substantial similarities and concluded that Dominion had not shown that the final report would have been materially different in the absence of anticipated litigation.
Information Security
Computer Security
Digital Evidence
Computer Systems
Data Networks
Identity Theft
Encryption
Risk Assessment
Insurance, +4
Insurance
Insurance, +2
Insurance
The pre-breach agreement mattered because it showed that Mandiant had already been expected to provide incident-response and forensic services before Dominion discovered the intrusion. When the court compared that work with Mandiant's post-breach investigation, it found substantial similarities and concluded that Dominion had not shown that the final report would have been materially different in the absence of anticipated litigation.