Lesson 5.4

5.4: Public Comms

8 minutes

Public Comms

Lesson 3.4 gave you the internal template: what happened, what we know, what we don’t, what we’re doing, when you’ll hear from us. The external version is the same skeleton with two extra constraints — every word will be read by plaintiffs’ lawyers, and every word will be read by the attacker, who knows exactly how much of it is true.

The gold standard for what not to do

Equifax, September 2017, remains the complete syllabus in a single case study:

  • They attributed the breach to a “sophisticated attack.” It was an unpatched Apache Struts vulnerability — public since March, exploited from May. The patch had existed for two months. “Sophisticated” became a punchline in congressional hearings, because the word is checkable and it was false.
  • They stood up the breach-response site on a separate, unaffiliated domain — equifaxsecurity2017.com — which looked exactly like a phishing site and trained millions of panicked people to type their details into lookalike domains. Security researchers registered clones within hours to prove the point.
  • Their own support account then tweeted a link to one of the fake domains — several times.
  • Early remedy terms appeared to require waiving rights to sue, retracted only after public fury.

Every one of those failures was a comms decision, not a security one. Each was avoidable on the day with the rules below.

The rules

Never characterize the attacker’s skill. “Sophisticated” is the most common first word in breach statements and it has never once helped. If the intrusion was genuinely advanced, the word sounds like excuse-making; if it wasn’t — and reporters will find out, because indictments, researchers, and leak-site posts are all public — you’ve handed them the headline. Describe what happened, not how impressive it was.

Say only what your logs can prove, phrased so it survives revision. The trap phrase is “we have no evidence that data was misused.” If your logging is thin, that sentence is technically true and functionally a lie — and when the scope grows (breach scopes only ever grow), your early absolutes become the story. The survivable phrasing is the 3.4 discipline turned outward: here’s what we know, here’s what we don’t know yet, here’s when we’ll update. Public statements that include honest unknowns age well. Statements that include confident absolutes age like Equifax’s.

Use your own domain and your own channels. Breach page on your primary domain. Notifications from your normal addresses. Anything else trains your customers for the phishing wave that follows every public breach — and there is always a phishing wave; attackers read breach news as targeting data.

Pre-draft the holding statement. The first public statement is ninety percent boilerplate — we’re aware, we’ve engaged experts, we’ve notified law enforcement, here’s where updates will appear. There is no reason to write it at 2 AM with counsel redlining over your shoulder. Write it this quarter; fill in blanks on the day.

When to speak

Between two forcing functions: after counsel has seen it (every external word, no exceptions — lesson 5.2’s clocks and the litigation both depend on it), but before the story escapes you. If customers are affected visibly, if employees know, if the crew has a leak site — the story is going to run. The only choice is whether it runs with your framing and your facts or with a screenshot of your outage and “the company did not respond to requests for comment.” MGM’s ten days of visibly dark casino floors made silence impossible; their terse early statements meant days of coverage sourced entirely from TikToks of broken slot machines. You don’t have to say much. You have to say something true, somewhere official, early.

One more Equifax note to end on: their CEO, CIO, and CSO were all gone within weeks — and the post-incident insider-trading investigations (one executive was convicted) began with questions about who knew what, when. Which is the same question every regulator, insurer, and reporter asks. The decision log in lesson 5.6 is how you answer it without flinching. First, though: Friday, 4:47 PM.