Your Team's Slack Messages During a Breach Could Cost More Than the Breach Itself

Key points

• Internal messages sent during a cyber incident, including Slack threads and emails, regularly become evidence in lawsuits and regulatory investigations.
• Copying a lawyer on a message does not make that message legally protected from disclosure.
• Courts have ruled that operational incident documents are discoverable even when a general counsel reviewed them afterward.
• AI note-taking tools used during incident response may already be undermining privilege protections, and case law has barely started catching up.
• The biggest financial risk after a breach is often not the attack itself, but what employees said about it during the response.

When a company finds out it's been hacked, the first instinct is to move fast. Get everyone on a call. Fire off messages. Start figuring out what broke.

That instinct is understandable. It's also how organisations end up paying far more than the cost of the breach itself.

Why does what your team says matter so much?

Every message sent during incident response becomes a potential record. Courts and opposing lawyers can demand access to that record later. What your team said, where they said it, and how they framed the problem can define how a judge or jury understands your organisation's responsibility.

This isn't a hypothetical. Internal communications from chaotic early hours routinely turn into courtroom exhibits months or years later, according to CSO Online.

The one-liners that cause the most damage tend to follow a pattern:

• "We were supposed to fix this six months ago."
• "Nobody takes this seriously."
• "We knew this was a risk."

Those sentences, typed in a moment of stress, are exactly what a plaintiff's lawyer is looking for.

Does adding a lawyer to the chat protect those messages?

No, and this is where a lot of organisations get caught out.

Attorney-client privilege is a legal protection covering communications between a client and their lawyer for the purpose of getting legal advice. Work-product protection is similar, covering documents prepared in anticipation of litigation. Both are real, but narrow.

Copying your general counsel on a Slack channel titled "ACP" doesn't make the whole channel protected. Courts look at whether the predominant purpose of a specific communication was to get or give legal advice. A technical timeline of what got patched and when, written by the security team for operational reasons, is almost certainly discoverable even if a lawyer saw it afterward. The Sedona Conference, a non-profit that produces widely cited legal guidance on cybersecurity and electronic records, has noted that courts are scrutinising this distinction more closely every year.

A 40-person Slack channel with a lawyer sitting quietly in it isn't a privileged space. It's a searchable archive.

Courts also don't limit discovery to the incident at hand. Opposing counsel can request documentation from prior incidents, including how the organisation handled those events and what processes existed.

What about AI tools used during incident response?

This is genuinely unsettled territory, and the failure mode here is invisible until it's too late.

If your team uses a consumer-grade AI tool, where the provider may train its models on what users type, anything shared with that tool could be considered disclosed to a third party. Courts have historically treated third-party disclosure as a waiver of privilege, and early decisions suggest the same logic applies to AI. We covered the broader risk of AI tool security in our 12 August story on agent wrappers, but the privilege angle is a separate problem that's moved faster than the legal frameworks around it.

AI note-takers in incident calls, automatic transcription tools, any system that captures and stores what was said: each raises the question of who else has access to that output. If the answer is an unprivileged group, privilege may already be gone.

What can organisations do right now?

The fix has to happen before the incident, not during it.

Separate channels for legal strategy and operational response need to exist before the breach, not get improvised on the day. Access to legal discussions should be limited to people who genuinely need to be there. Tabletop exercises, practice drills where teams walk through a simulated incident without real stakes, are the right time to test whether those separations actually hold.

If you're a customer of a breached organisation, watch for notification letters and consider whether personal information you shared, financial details, health records, login credentials, needs to be updated or monitored.

Document your incident response process in writing before you need it. The one your team improvises at 2 a.m. Is the one that ends up in front of a judge. That's the part vendors selling IR retainers won't put in the brochure.