3 Rules for Communicating Post-Crisis, Cyber Attack 101

By Doug Randall On Nov 17, 2017

Listen up… a cyber-attack is likely to happen to your organization. The majority of attacks to date have focused on organizations that have large databases or a point of sale system. According to a recent Heritage Foundation report, major breaches in 2016 occurred in organizations across all verticals including Yahoo, the U.S. Treasury Department, Oracle, The Wendy’s Organization, Banner Health, Citibank, and even the Office of Homeland Security (FBI).

And then there was the breach in 2017 releasing 198 million US voter records as reported via Wired due to an IT mishap. This is just a sample of the largest breaches reported and doesn’t include any of the smaller breaches that impact organizations and individuals daily.

What’s an organization to do post-attack? Prepare you communications plans now, prior to experiencing an attack and get ahead of a crisis. The immediate impact on brand reputation and long-term financial impact from a breach are significant. A study of the narratives surrounding data breaches by Protagonist.io uncovered that the types of communications post-breach can significantly affect your brand and financial viability for years to come. Take time to plan now.

Also Read: The Fight Against Fraud: Are You Throwing Good Traffic Out with the Bad?

Here are 3 rules to follow post cyber attack–

Step 1. Admit the Breach

Honesty is the best policy here. Be honest with the public and report the breach quickly. Beliefs regarding cyber attacks across the board are negative, with 42% of the conversation about cyber attacks dominated by negative narratives. However, because the public has become “used to” these types of attacks the public is a little more tolerant than in years past.

Develop communications that speak to the neutral narrative in the landscape (beliefs that cyber attacks will not stop and that businesses are going to continue to be targets). Acknowledging that your company and everyone is at risk, lessons the impact and damage to your brand. It is critical to also ensure that the weakness or issue that allowed the data breach is fixed and also publicly addressed.

Step 2. Collaborate with Authorities

It’s imperative to work with federal investigators such as the FBI who work to find the culprits post-attack. Communicating to your customers and the general public that your company or business is working with the proper authorities is a critical step in any crisis mitigation, especially cyber attacks.

Transparency about partnering with law enforcement taps into the beliefs about cyber attacks. Focus on communicating about joining forces and sharing information with authorities stop cybercriminals as this is one of the key narratives that will help secure brand reputation and public perception.

Also read: Four Questions Marketers Need to Ask When it Comes to Brand Safety and Video

Step 3. Be Proactive

Immediately following a cyber attack, companies must start proactive communications with customers and the public. This means communicating plans for preventing future attacks on their business or organization and remediation as early as the day they’ve become a victim. Do not wait for the breach to be uncovered by media or watchdog groups- this type of scandal only adds to the negative perceptions and ongoing mistrust of organizations post-breach.

Implementing reform, education, and technical upgrades to protect data, employees, and customers from cyber attacks is crucial to rebuild trust and restore brand equity. It’s imperative to include this as part of your communication strategy, including the steps being taken to mitigate damage and prevent future attacks assures the public you are being proactive and well prepared.

Guilt by association should be the term used when discussing cyber attacks. It turns out with each new attack, previous hacking stories are revived and in turn, stir up the public’s bias against earlier victims. It is like a domino effect as each subsequent attack fuels negative beliefs about the companies who were past victims, often times many years later.

Proactive planning including a communications strategy using narratives that resonate with your customers and the public is imperative for organizations to avoid prolonged brand damage and loss of public trust. Organizations today cannot afford to think cyberattacks won’t happen to them.