Cyberincydent bardzo rzadko pozostaje wyłącznie problemem technicznym.
Nawet jeśli zaczyna się od infrastruktury, kont użytkowników lub systemów, błyskawicznie przenosi się do sfery reputacji i zaufania. W takim momencie kluczowe staje się nie tylko to, co się wydarzyło, ale przede wszystkim to, jak firma na to odpowiedziała. Warto bowiem pamiętać, że wiele organizacji przegrywa nie samym incydentem, lecz właśnie sposobem, w jaki o nim komunikuje.
Należy przy tym podkreślić, że dobrze poprowadzona komunikacja nie cofnie wycieku danych ani nie naprawi systemów, ale może skutecznie ograniczyć chaos i ochronić wiarygodność marki. Zła komunikacja działa odwrotnie – wzmacnia emocje i pogłębia kryzys. Jednym z najpoważniejszych zagrożeń na tej drodze jest najczęstszy i najbardziej kosztowny błąd: zwlekanie z przekazem w oczekiwaniu na „pełny obraz sytuacji”. Dlatego powstał artykuł, który przedstawi 5 najczęstszych błędów komunikacyjnych
Cisza wcale nie jest neutralna
Jeśli organizacja milczy zbyt długo, klienci zaczynają podejrzewać ukrywanie prawdy, media szukają danych u osób trzecich, a pracownicy i social media wypełniają tę próżnię domysłami. W konsekwencji brak reakcji szybko staje się symbolem utraty kontroli i braku szacunku wobec poszkodowanych.
To avoid this worst-case scenario, it is worth examining your defences. Below you will find five mistakes that companies most commonly make following a cyber incident – along with advice on what to do instead.
Why is communication following a cyber incident so important?
In the hours immediately following an incident, an organisation typically focuses on urgent matters: assessing the scale of the problem, mitigating damage, restoring services, and liaising with the IT and security teams, legal advisors or external partners.
That’s only natural. The problem arises when communication is treated as a secondary issue – something we’ll deal with later, once the situation has been better understood.
Meanwhile, just as the company is still gathering information, a narrative begins to take shape:
- customers are noticing problems,
- partners ask about the risks,
- staff are exchanging unconfirmed information,
- the media are trying to find out what is going on,
- social media is starting to take on a life of its own.
If an organisation does not speak out early enough and clearly enough, it loses the opportunity to influence how the crisis is perceived.
Mistake 1: Staying silent for too long
Waiting for the ‘full picture’ is a costly mistake. In a crisis, silence is not neutral – it is interpreted to the company’s disadvantage.
The lack of timely updates means that:
Customers are losing trust and suspecting a conspiracy.
The media and social media are filling the void with speculation and theories.
Employees create their own unofficial accounts of events.
Silence signals a loss of control and a lack of respect for those affected. In crisis communication, speed is more important than the completeness of the information.
What to do instead
In the early stages of a crisis, you don’t need to have all the answers. Instead, you need to demonstrate that:
- the company is aware of the problem,
- is working on analyzing it,
- takes the situation seriously,
- and will be back with more updates.
A brief, thoughtful initial message is usually better than waiting a long time for the “perfect statement.”
Mistake 2: A message written in technical or legal language
This mistake is particularly common when initial communications are based primarily on input from the technical or legal team. Such messages may be grammatically correct, but they are completely incomprehensible to the end user.
It contains phrases such as:
- “Anomalies were observed in the production environment,”
- “remedial procedures have been implemented,”
- “Access to certain resources cannot be denied,”
- “An analysis of the incident's impact is currently underway.”
From the perspective of a customer or the general public, this kind of language does not inspire trust. On the contrary, it gives the impression that you are avoiding specifics or hiding behind jargon.
What to do instead
Communication following a cyber incident should be:
- simple
- clear,
- specific,
- and tailored to the audience.
The customer wants to know:
- what happened,
- does this apply to him,
- what the company does,
- what should be done,
- when more information becomes available.
Technical language has its place in professional collaboration. However, external communication requires translating the issue into language that is understandable and accessible.
Mistake 3: Downplaying the problem or adopting an overly defensive tone
Many organizations, in an effort to limit the reputational impact of an incident, fall into the trap of over-reassuring the public. This leads to statements suggesting that:
- the problem is minor,
- the situation is under control,
- there is no cause for concern,
- everything is working normally.
However, if customers see something else—such as service outages, media reports, or alarming news about a data breach—that tone begins to backfire on the company.
Defensive communication is just as ineffective, as it focuses more on protecting the organization’s image than on addressing the public’s genuine concerns. Customers can quickly sense when a brand is primarily trying to whitewash itself.
What to do instead
The tone is the best:
- calm,
- responsible,
- factual,
- but not aloof or cautious.
The company doesn't need to overreact. However, it should make it clear that:
- I understand the gravity of the situation,
- takes its audience seriously,
- does not underestimate the potential consequences,
- and takes responsibility for communication.
During a crisis, a brand that speaks honestly about the problem is more credible than one that tries to reassure everyone too soon.
Mistake 4: Inconsistent messaging across different channels
This is a problem that particularly affects organizations with multiple teams and communication channels. Different messages appear on the website, different ones are sent to customers via email, and still others are posted on social media; on top of that, call center agents or sales representatives convey their own versions of the situation.
Such inconsistency quickly undermines credibility.
If customers see different information in different places, the question arises: does the company really know what’s going on?
Inconsistency is particularly harmful when the following differ:
- the scale of the problem,
- the scope of the affected services,
- the level of risk to customers,
- or announced follow-up actions.
What to do instead
An organization needs a single, consistent core message from which all versions of the message are derived:
- for customers,
- for the media,
- for partners,
- for employees,
- for social media channels.
Different audiences need different levels of detail, but they shouldn’t be presented with conflicting versions of reality.
In practice, this means there needs to be close cooperation between:
- safety,
- IT,
- PR,
- marketing,
- legal,
- and the management board.
Mistake 5: Treating a single message as the end of the conversation
This is a very common mistake made after the first wave of a crisis. A company issues a statement, sends out an email, or posts information on its website, and then goes silent. From an internal perspective, this may seem like the end of the communication phase. From the recipient’s perspective, however, it very often signals a new wave of uncertainty.
After a cyber incident, people expect not only an initial statement, but also:
- updates,
- further explanation,
- updates on the progress of activities,
- and a sign that the organization has truly learned from its mistakes.
If there is silence after the initial announcement, the brand may once again be perceived as opaque or passive.
What to do instead
Communication following an incident should be a process, not a single statement.
It’s worth planning:
- the first statement confirming the situation,
- Further updates as progress is made,
- information on corrective actions,
- communication following the resolution of the incident,
- and, in some cases, a message explaining what the company has changed in the wake of the crisis.
It is precisely this consistent communication that creates the impression that the organization is in control of the situation and does not abandon its audience after the initial phase of the crisis.
What do companies that effectively communicate cyber incidents have in common?
Organizations that manage a cyber crisis relatively well in terms of communication typically share several common characteristics.
They have been prepared in advance
They don’t wait until a problem erupts to start thinking about communication. They have at least basic scenarios, roles, and procedures in place.
They use simple language
They don’t hide behind formalities, and they don’t try to sound more professional at the expense of clarity.
They take their audience seriously
They understand that customers, partners, and employees don’t expect perfection, but they do expect honesty and accountability.
They combine technical expertise with a strong reputation
They know that fixing the systems and rebuilding trust are two separate processes that must proceed in parallel.
How to prepare your organization to avoid making these mistakes
It should be made clear that the best time to prepare communication strategies following a cyber incident is not the day the attack occurs, but the period leading up to it. Therefore, as part of crisis prevention, it is advisable to develop specific resources that will enable immediate action.
In practice, it is essential to have ready-made components such as:
- basic communication response scenarios,
- templates for preliminary statements (so-called holding statements),
- a decision matrix specifying who ultimately approves the messages,
- a clear division of responsibilities among IT, security, PR, marketing, the legal department, and management,
- a list of key target audiences,
- a procedure for regularly updating information across various channels,
- and, above all, a detailed communication plan for the first 24–48 hours.
It is worth noting that it is precisely this level of preparedness that most often distinguishes organizations that emerge from a crisis with limited reputational damage from those that only exacerbate the problem through their own chaotic response. Ultimately, in the hour of crisis, it is not good intentions that matter, but the effectiveness of procedures that have been rehearsed in advance.
Summary: In a cyber crisis, communication can either save the day or make matters worse
Following a cyber incident, an organization is judged not only on the basis of whether an attack, data leak, or data breach occurred. It is also judged on how it communicates, how it treats its audience, and whether it can act responsibly under pressure.
The most common mistakes are:
- Staying silent for too long
- incomprehensible language,
- downplay the problem
- inconsistent messages,
- treating a single statement as the end of the conversation.
The good news is that all of these mistakes can be avoided—provided that the organization treats a cyber incident not only as a security issue, but also as a reputational crisis requiring careful communication.