Crisis communications: what to say when you're breached (and what not to)

Key takeaways

• Silence and over-promising are the two failure modes — say what you know, commit only to what you can deliver.
• Draft holding statements for employees, customers, regulators, and press before an incident so hour one isn't spent writing from scratch.
• Coordinate comms with legal and IR: a premature or inaccurate statement can create liability and contradict your own filings.

Communications is a workstream, not an afterthought

While the technical team contains and recovers, a parallel workstream decides how the incident is understood by everyone outside the bridge call — employees who can't log in, customers whose data may be involved, regulators with reporting clocks, and eventually the press. How that's handled shapes the reputational outcome as much as the technical response shapes the operational one. Treating comms as something to figure out later is how good technical recoveries become public-relations disasters.

The two ways this goes wrong

There are two classic failure modes. The first is silence — going dark while rumors, and the attacker's own leak site, fill the vacuum with a worse story than the truth. The second is over-promising: assuring customers 'no data was affected' before the investigation could possibly know, then having to walk it back and destroying credibility. The discipline is to say what you actually know, acknowledge what you're still determining, and commit only to what you can deliver.

Draft the statements before you need them

The templates you want in hand include a holding statement for employees, a customer notification, a regulator notification aligned to your reporting obligations, and a press holding line. Drafting these in advance — with the specifics blanked — means hour one is spent filling in facts, not composing prose under pressure. Pre-approved templates that legal and leadership have already blessed also prevent the delay of routing a first draft through five reviewers during a crisis.

Coordinate with legal and the investigation

Communications cannot run ahead of the facts or the lawyers. A public statement that contradicts your regulatory filing, or that asserts something the forensic investigation later disproves, creates liability and hands critics a story. Every external statement should be reconciled with legal counsel and with what the investigation actually supports. The goal is to be honest, timely, and consistent across every audience — which is far easier when the words were drafted calmly in advance and are released deliberately, not reactively.