Your Team's Slack Messages During a Breach Could Cost More Than the Breach Itself

Key points

• Internal messages sent during a cyber incident, including Slack threads and emails, regularly become evidence in lawsuits and regulatory investigations.
• Simply copying a lawyer on a message does not make that message legally protected from disclosure.
• Courts have ruled that operational incident documents are discoverable even when a general counsel reviewed them afterward.
• AI note-taking tools used during incident response may already be undermining privilege protections, and case law has barely started catching up.
• The biggest financial risk after a breach is often not the attack itself, but what employees said about it during the response.

When a company finds out it has been hacked, the first instinct is to move fast. Get everyone on a call. Fire off messages. Start figuring out what broke.

That instinct is understandable. It is also how organisations end up paying far more than the cost of the breach itself.

Why does what your team says matter so much?

Every message sent during an incident response becomes a potential record. Courts, regulators, and opposing lawyers in lawsuits can demand access to that record later. What your team said, where they said it, and how they framed the problem can define how a judge or jury understands your organisation's responsibility.

This is not a hypothetical. CSO Online has documented how internal communications from chaotic early hours turn into courtroom exhibits months or years later.

The one-liners that cause the most damage tend to follow a pattern:

• "We were supposed to fix this six months ago."
• "Nobody takes this seriously."
• "We knew this was a risk."

Those sentences, typed in a moment of stress, are exactly what a plaintiff's lawyer is looking for.

Does adding a lawyer to the chat protect those messages?

No, and this is where a lot of organisations get caught out.

Attorney-client privilege is a legal protection, meaning communications between a client and their lawyer for the purpose of getting legal advice cannot normally be forced into court. Work-product protection is similar, covering documents prepared in anticipation of litigation. Both are real, but narrow.

Copying your general counsel on a Slack channel titled "ACP" (an abbreviation for attorney-client privilege) does not make the whole channel protected. Courts look at whether the main purpose of a specific communication was to get or give legal advice. A technical timeline of what got patched and when, written by the security team for operational reasons, is almost certainly discoverable even if a lawyer saw it afterward. The Sedona Conference, a non-profit organisation that produces widely cited legal guidance on cybersecurity and electronic records, has noted that courts are scrutinising this distinction more closely every year.

A 40-person Slack channel with a lawyer sitting quietly in it is not a privileged space. It is a searchable archive.

What about AI tools used during incident response?

This is genuinely unsettled territory, and the failure mode here is invisible until it is too late.

If your team uses a consumer-grade AI tool, meaning an artificial-intelligence product where the provider may train its models on what users type, anything shared with that tool could be considered disclosed to a third party. Courts have historically treated disclosure to outside parties as a waiver of privilege. Early decisions suggest the same logic applies to AI.

AI note-takers in incident calls, automatic transcription tools, any system that captures and stores what was said: each one raises the question of who else has access to that output. If the answer is "an unprivileged group", privilege may already be gone.

One thing the post-mortem will say, eventually, is that the organisation never thought to audit which tools were running during the response.

What can organisations do right now?

In practice, the fix has to happen before the incident, not during it.

Separate channels for legal strategy and operational response need to exist before the breach, not get improvised on the day. Access to legal discussions should be limited to the people who genuinely need to be there. Tabletop exercises, which are practice drills where teams walk through a simulated incident without real stakes, are the right time to test whether those separations actually hold.

If you are a customer of a breached organisation, watch for notification letters and consider whether any personal information you shared, financial details, health records, login credentials, needs to be updated or monitored. The incident itself may be out of your hands. What your organisation says about it is not.

The operational takeaway: document your incident response process in writing before you need it, because the one your team improvises at 2 a.m. is the one that ends up in front of a judge.