In Harleysville Insurance Co. v. Holding Funeral Home, Inc., No. 1:15cv00057 (W.D. Va. Feb. 9, 2017), an insurance declaratory judgment action, the plaintiff insurance company used the file-sharing site “Box” to share ESI with the third-party National Insurance Crime Bureau (“NICB”). Critically, the plaintiff failed to use a password to protect its Box site, leaving its ESI accessible to “any person who had access to the internet . . . simply by typing in the URL address in a web browser.” When defendant subpoenaed NICB, an email containing the Box URL address was produced. Defendant subsequently used the Box URL address to access the site and download all of plaintiff’s stored ESI without notifying the plaintiff. When defendant then produced plaintiff’s own ESI in discovery, plaintiff moved to disqualify defense counsel for having accessed plaintiff’s ESI, which included material covered by the attorney-client privilege and the work product doctrine. The court, applying Virginia privilege law, found that plaintiff had not used reasonable precautions to prevent disclosure when it used the Box site without password protection. Because “its actions were the cyber world equivalent of leaving its claims file on a bench in the public square and telling its counsel where [to] find it,” the plaintiff had waived any attorney-client privilege. Applying federal law, the court further held that that Federal Rule of Evidence 502 did not protect the ESI as work product because plaintiff’s disclosures were not inadvertent nor were plaintiff’s precautions reasonable. Accordingly, the court denied plaintiff’s disqualification motion. However, the court also sanctioned the defendant, taxing plaintiff’s costs for bringing the motion, because defendant had not revealed plaintiff’s disclosure nor sought a court determination on the waiver issues, despite clear confidentiality legends on the NICB email containing the Box URL address.