How an organisation communicates during an incident shapes the outcome more than the technical severity does. Customers forgive breaches considerably more readily than they forgive being misled about one, and regulators weigh the quality and timeliness of notification heavily.

Know your deadlines before an incident

Notification obligations are jurisdiction and sector specific, and several are measured in hours rather than days. Establish in advance which regimes apply to you, what triggers a notification, who must be told, and who signs it off. Discovering these obligations during an incident guarantees missing them.

Structure the message around the reader

People want to know three things immediately: does this affect me, what was exposed, and what should I do now. Answer those first. Background about your infrastructure and your commitment to security belongs further down, if at all. If action is required — change a password, watch for specific phishing — put it in the first paragraph, in plain language.

Say what you do not know

Early information is incomplete. "We do not yet know whether X was affected; we expect to confirm by Thursday and will update you then" builds more trust than confident statements later contradicted. Then meet the commitment, including when the update is that there is nothing new.

Language that damages trust

  • "Sophisticated attack" when the cause was an unpatched system or a reused password.
  • "No evidence of misuse", offered as reassurance when you have limited detection capability.
  • "We take security seriously", which reads as filler in the context of a breach.
  • Passive constructions that avoid saying what happened and who is responsible.

Prepare for the follow-on fraud

Breach notifications are followed by phishing that impersonates the breached company, targeting exactly the people who just received a genuine notice. Tell customers explicitly what you will and will not do — that you will never call asking them to move money or read out a code — and give them a verified route to contact you.

Write the templates now

A holding statement, a customer notification, a regulator notification, and internal guidance for anyone who answers the phone. Drafted calmly in advance, reviewed by legal, and stored somewhere accessible when your systems are not. During an incident there is no time to write well, and it shows.