What You Say After a Cyberattack Can Save… or Sink Your Company

When a company suffers a cyberattack, the immediate priority is usually technical: contain the incident and restore systems. But while IT is working, another crisis is also growing: customers, employees, suppliers, and the media are looking for answers.

At that point, cyber crisis communication stops being a public relations issue and becomes a damage-control tool. A clear message reduces uncertainty, protects trust, and prevents silence from being interpreted as a lack of transparency.

Many organizations prepare firewalls, backups, and technical protocols, but not what they will say when the incident becomes public. In ransomware, data leaks, and cyber extortion, communicating too late or poorly makes the crisis worse.

What Is Cyber Crisis Communication?

Cyber crisis communication is the set of messages, owners, channels, and decisions an organization uses to provide information during a security incident. 

Its purpose is not to downplay the problem, but to explain what is known, what is being investigated, what measures have been taken, and what affected people should do.

The NCSC in the UK notes that, during an incident, organizations often prioritize the technical response and relegate communications. However, clearly informing employees, customers, stakeholders, and the media is crucial to public perception of the response.

This is especially important if the incident involves data theft, ransomware, or pressure from attackers. The company needs to speak with one voice and avoid contradictions, even when it does not yet have all the answers.

The frequency of incidents shows that this cannot be improvised.

Why What You Say Can Reduce Reputational Damage

After a ransomware attack, the company must do more than restore systems. It must also protect the trust of customers, employees, investors, partners, suppliers, and regulators. 

Reputation suffers when the organization appears disorganized, hides information, or changes its version of events repeatedly.

Good communication does not eliminate the incident, but it reduces secondary damage. Explaining that the investigation is ongoing, providing contact channels, and giving concrete instructions prevents third parties from filling information gaps with rumors or messages from the attacker.

The Risk of Staying Silent

Staying silent may seem prudent when details about the incident are still missing and the company needs time to verify what happened, assess the scope, and coordinate a response.

But if customers or employees learn about the incident from third parties, the company loses the ability to explain the context and manage the communication.

What a Company Should Say in the First Hours

Initial communication should be brief, accurate, and honest. Companies should avoid speculation, assigning blame without evidence, or promising unconfirmed recovery times. 

The recommended approach is to explain what has been detected, what may be affected, what actions have been taken, and when the next update will be provided.

NIST updated its SP 800-61 Rev. 3 incident response recommendations in 2025, aligning incident management with the Cybersecurity Framework 2.0. This approach reinforces that response should not be separated from risk management, governance, and internal coordination.

For this reason, the public message must be connected to the cyberattack response plan. Legal, executive leadership, IT, communications, customer service, and compliance should validate the information without delaying useful updates that reduce risk.

Before publishing a statement, the company should answer three questions: what do we know for certain, what are we still investigating, and what does the audience need to do? Without these answers, the message will create more uncertainty than trust.

Internal Communication: The Message That Prevents Chaos

Internal communication is just as important as external communication. If employees do not receive clear information, they may share inaccurate details, give customers contradictory answers, or fall for new phishing campaigns that exploit the confusion surrounding the incident.

A business cybersecurity strategy should include prepared messages for employees, executives, support, sales, customer service, and critical suppliers. Each group needs to know what it can say, what it should not say, and where to direct sensitive questions.

It is also advisable to establish alternative channels. If corporate email is compromised or under investigation, the company should have secure ways to coordinate decisions.

External Communication: Customers, Suppliers, Regulators, and Media

External communication should be tailored to each audience. A customer needs to know whether their data, services, or accounts are at risk. A supplier needs to know whether integrations should be suspended or credentials changed. A regulator expects notifications within the applicable deadlines.

When personal data is compromised, the guidance from the ICO on personal data breaches states that a notifiable breach must be reported without undue delay and, at the latest, within 72 hours of the organization becoming aware of it. 

If there is a high risk to individuals, affected people must be informed directly and without undue delay.

Although deadlines vary by jurisdiction, the principle is the same: an internal investigation alone is not enough. Communication must be coordinated with compliance, privacy, and business data protection teams so the organization can provide the necessary information without disclosing details that increase risk.

The reputational impact of a breach is not hypothetical: it already appears in official statistics on incident consequences.

Ransomware, Data Leaks, and Extortion: How the Message Changes

Communication becomes more sensitive when an incident involves ransomware, data theft, or threats to publish information. In these cases, the company may be under pressure from criminals seeking to influence customers, employees, and business partners.

The CISA StopRansomware Guide recommends creating, maintaining, and exercising a basic incident response plan and an associated communication plan for ransomware, data extortion, and breaches.

This connects directly with cyber extortion. If attackers threaten to publish files or contact customers, the statement should acknowledge the risk without amplifying the criminals’ message.

If there is a potential dark web data leak, the company should avoid absolute claims. It is better to state that the scope of the exfiltration is being investigated and that affected parties will be informed when verified information is available.

What Should Not Be Said

Companies should not minimize the incident, blame third parties without evidence, deny an unconfirmed data leak, or publish technical details that could help the attacker. 

It is also not advisable to improvise different answers for customers, the press, and employees. Message consistency is part of containment.

How to Prepare a Cyber Crisis Communication Plan

A cyber crisis communication plan should be written, tested, and connected to technical recovery plans. It should reflect the company’s actual risks, its audiences, its regulatory obligations, and its critical services.

At a minimum, it should include spokespeople, approval owners, initial messages, frequently asked questions, alternative channels, escalation criteria, and an update schedule. 

It should also cover ransomware, data theft, service outages, and public exposure.

It should be rehearsed alongside cyber resilience exercises. A resilient company also maintains trust, coordinates decisions, and communicates responsibly under pressure.

Conclusion

Cyber crisis communication can make the difference between an orderly response and a reputational crisis. During a cyberattack, a company cannot control everything: it cannot control the attacker, rumors, or always the recovery timeline. But it can control the quality, clarity, and responsibility of its message.

Preparing that communication before an incident saves time, reduces contradictions, and protects trust. At HelpRansomware, we support companies responding to ransomware, digital extortion, and the recovery of critical information.

FAQ