This looks to be another case where a court shoots downs claims of attorney-client privilege for a breach-related report. And once again, it seems to be a situation in which the firm could not show that the breach litigation was the sole purpose of the report or with whom it was shared.
Read about this case on Law360 (subscription required).