Lead story
Federal Water-Sector Alerts Expose an Evidence-Preservation Gap During PLC Recovery
New federal alerts on attacks against internet-exposed water-system controllers provide inspection and recovery steps but do not specify who should preserve a compromised controller's running configuration before restoration changes or erases it.
- What happened
- New federal alerts on attacks against internet-exposed water-system controllers provide inspection and recovery steps but do not specify who should preserve a compromised controller's running configuration before restoration changes or erases it.
- Why it matters
- Incident-response plans for operational technology should identify in advance which qualified personnel may preserve project files, configurations, logs, engineering-workstation records, and third-party service records without delaying safe restoration. The plan should also identify who has authority to decide when preservation is technically feasible.
- Watch
- Federal agencies have not publicly attributed the reported activity, and public reports do not establish how many targeted systems were accessed. The federal guidance includes diagnostic and backup measures but does not create a litigation-preservation protocol.
Sourcescomplexdiscovery.comcisa.govfbi.gov
Briefing item
EY Third-Party Tax-Data Breach Moves Into Class-Action Discovery
EY disclosed that an unauthorized party downloaded tax-related client documents from a third-party IT service-management platform, and a proposed federal class action filed July 20 is likely to focus discovery on vendor-held data and incident-response records.
- What happened
- EY disclosed that an unauthorized party downloaded tax-related client documents from a third-party IT service-management platform, and a proposed federal class action filed July 20 is likely to focus discovery on vendor-held data and incident-response records.
- Why it matters
- Help-desk and IT service-management platforms can become repositories for regulated client documents. Data maps, retention schedules, litigation holds, and vendor contracts should address ticket attachments, access logs, breach-notification timing, and the practical ability to obtain records held by the service provider.
- Watch
- EY has not attributed the disclosed breach to ShinyHunters, and the group's broader access claims were not independently verified. Public state counts are partial and do not establish the total affected population.
Sourcescomplexdiscovery.comoag.ca.govdockets.justia.com
Briefing item
Court Says ESI Protocols Do Not Excuse Collection From Obviously Relevant Employees
A Washington federal magistrate judge held that custodian lists and search-term workflows implement Rule 34 obligations but do not narrow the governing discovery requests or excuse collection from plainly relevant employees.
- What happened
- A Washington federal magistrate judge held that custodian lists and search-term workflows implement Rule 34 obligations but do not narrow the governing discovery requests or excuse collection from plainly relevant employees.
- Why it matters
- Custodian caps, negotiated keywords, and TAR workflows should be treated as implementation tools rather than the complete definition of collection scope. Teams need an escalation process for plainly relevant people, shared repositories, or segregable records discovered after the protocol is set.
- Watch
- The July 17 order resolved a case-specific discovery dispute and allowed targeted rather than wholesale expansion. The linked opinion is hosted by Minerva26, and the eDiscovery Today analysis is educational commentary rather than legal advice.
SourceseDiscovery Todayapp.minerva26.com
Briefing item
Federal Court Orders Detailed Disclosure of ESI Search Methods After Keyword Gaps
A Vermont federal court rejected a late demand to rerun discovery using an opponent's proposed terms but ordered the producing party to disclose custodians, sources, date ranges, search terms, hit counts, and counsel's supervision and validation steps.
- What happened
- A Vermont federal court rejected a late demand to rerun discovery using an opponent's proposed terms but ordered the producing party to disclose custodians, sources, date ranges, search terms, hit counts, and counsel's supervision and validation steps.
- Why it matters
- Search defensibility depends on a reproducible record of who and what was searched, when searches ran, which terms or classifiers were used, what results they returned, and how counsel tested the process. The same documentation discipline applies when teams use TAR or other technology-assisted methods instead of keywords alone.
- Watch
- The underlying order was issued July 16, 2026, and the source is an EDRM practitioner analysis. The ruling applied the facts and control standard presented in the District of Vermont.
Sourcesedrm.net
Briefing item
Caddi Reports Am Law 50 Use of Agents for High-Volume Conflict Checks
Legal IT Insider reports that Caddi is offering an agent that builds workflow agents for law-firm operations, including client intake, conflict checks, document filing, billing preparation, and CRM updates.
- What happened
- Legal IT Insider reports that Caddi is offering an agent that builds workflow agents for law-firm operations, including client intake, conflict checks, document filing, billing preparation, and CRM updates.
- Why it matters
- Agents that perform intake, conflicts, filing, and records updates can create or modify information that later falls within preservation and discovery obligations. Legal operations teams should define access controls, exception handling, activity logs, retention, and human approval points for each automated workflow.
- Watch
- The deployment volume, product capabilities, and funding details are company claims reported in a startup profile and were not independently tested or audited.
SourcesLegal IT Insidertrycaddi.com
Educational only. Not legal advice. Review sources and matter-specific obligations before relying on any workflow decision.