How to communicate a crisis without increasing the damage

A statement can be a second incident. I have seen organisations deny the obvious, others confess what they still do not know, and others let an improvised spokesperson discuss forensic nuances on television. All three worsen the damage.

The correct order

1. Verified facts, with a time.
2. Known scope and scope still unknown, stated as such.
3. What is being done now.
4. When there will be an update, even if there is no news.
5. How clients or employees can protect themselves, if it applies.

What is not said

Authorship is not attributed without evidence. The vulnerability is not detailed as a tutorial. It is not promised that “everything is under control” if the RTO is still a hypothesis. The incident is not used to sell services. The dignity of communication is in not asking the public to accept adjectives without facts.

A single spokesperson

Legal, security and communications prepare. One person speaks. The rest of the organisation redirects. On social networks, coordinated silence is a form of communication. Debate with anonymous accounts is not.

Errors that increase the damage

• Denying before verifying, and then having to deny the denial.
• Speaking in technical language to audiences that need to know whether their data or their money is safe.
• Multiplying spokespersons with different versions of the same fact.
• Promising recovery deadlines that the crisis committee cannot yet sustain.
• Letting the institution’s silence be filled by a better-written rumour.