One of the most significant questions in data security law is whether reports created by forensic firms investigating data breaches at the direction of counsel are protected from discovery in civil class action lawsuits. They are, at least according to an order issued last week in In re Experian Data Breach Litigation. 15-01592 (C.D. Cal. May 18, 2017). This alert analyzes the decision, identifies important practical takeaways for counsel, and places it in context with the two other cases that have addressed this issue.