One voice, consistent facts
Customers, employees, reporters, business partners, and regulators will all ask questions, and inconsistent answers do more damage than slow ones. A short set of approved statements, updated as the investigation develops, keeps support staff, executives, and sales teams from improvising. Speculation about who was behind the attack or how many people were affected tends to be quoted back later, especially when it turns out to be wrong. Internal messages to staff deserve the same care, since they are often forwarded outside the company within hours. If the company is publicly traded, disclosure counsel should see anything said to investors.
What to offer the people affected
Notices commonly come with an offer of credit monitoring or identity restoration services, and some state laws expect such an offer when certain identifiers are involved. A call center or dedicated web page can absorb questions that would otherwise land on front-line staff, but scripts should be reviewed so they do not promise more than the facts support. Be careful with language about fault and with assurances that the information was not misused, since those can be hard to stand behind later. Consider, too, what business customers need from you to meet their own obligations downstream. When notices go out in waves, each new group should receive information consistent with what earlier recipients were told, updated where the facts have changed.
Where we usually come in
Some companies call us on the first day; others call after notices have gone out and complaints or regulator letters begin to arrive. Either way, we start by reconstructing the timeline, the statements already made, and the investigation's current findings, and we identify which obligations remain open. If lawsuits or inquiries look likely, we put a litigation hold in place and coordinate with the insurer on defense and coverage. The aim is a response the company can explain later, line by line, to someone who was not in the room when the decisions were made.
