How to Communicate a Cyberattack or Ransomware Incident Without Destroying Customer Trust

It's 6:40 a.m. on a Monday. The head of IT calls the CEO: the servers won't boot, the shared files have a strange extension, and every folder contains a text file with instructions on how to "recover your data." By 8:00 a.m., employees can't clock in or access the ERP. By 9:30, a customer is asking on social media why the website is down. By 11:00, a cybersecurity reporter emails the communications team: a ransomware gang has added the company's name to its victim leak site on the dark web.

At that point, nobody in the company knows exactly what happened, what data was affected, how long the outage will last or whether the attackers have a copy of the information. And yet everyone—customers, staff, suppliers, the media and, very soon, the data protection authority—expects an answer. That is the central paradox of communicating a cyberattack: you have to speak before you know, and whatever you say in the first few hours will be on the record forever.

This guide isn't about how to technically contain an attack—that's the job of your security team and incident response specialists. It's about something just as decisive for the company's future: how to communicate it so your customers' trust survives the incident. Everything here applies to an industrial SMB, an e-commerce business, a clinic, a consulting firm or a retail chain. No industry is immune.

Banking data illustrates the fragility of digital trust remarkably well: nearly nine out of ten customers trust their bank with their data, yet two out of three admit they would probably leave after a serious breach. If that happens in the industry with the most regulation, the biggest security budgets and the strongest historical loyalty, imagine what it could mean for a company whose customers have alternatives just a click away. A breach doesn't destroy trust on its own: what destroys it, almost always, is poorly handled communication about the breach.

1. Why a cybersecurity crisis is unlike any other

Anyone who has already managed a classic reputational crisis—a defective product, a viral video of bad service, an unfortunate remark by an executive—tends to assume a cyberattack is handled the same way. It isn't. The general principles of corporate reputational crisis management still apply, but a cybersecurity incident adds four traits that make it a fundamentally different kind of crisis.

1.1. The temptation of silence (and why it almost never works)

Faced with so much uncertainty, many leadership teams instinctively want to say nothing until they have every answer. It's understandable, but rarely viable. Employees already know something serious is going on because they can't work; customers notice the service outage; the attackers themselves may announce the attack on their leak site. If the company stays silent, others will write the story: technical forums, specialist reporters, former employees on social media or the criminal group itself.

Using these terms rigorously isn't an academic exercise. Saying "we've suffered a data breach" when you don't yet know whether data was exfiltrated can cause unnecessary alarm; saying "no customer data was affected" before it has been verified can become, two weeks later, the headline that sinks your credibility for good.

2. The crisis team: IT, legal, communications and leadership at the same table

The most common organizational mistake in a cyberattack is for each function to work in its own lane: IT trying to restore systems, legal counsel preparing the notification, communications drafting a statement and leadership talking to key accounts on their own. The result is contradictory messages, commitments that can't be kept and statements that weaken the company's legal position.

The solution is a small crisis team with clear roles and a single decision channel. If your company already has crisis communication protocols, the cyberattack scenario needs its own annex, because the people at the table are different from those in a product crisis or a social media crisis.

Function	Main responsibility	Typical mistake to avoid
IT / Security (and external incident response)	Contain, investigate the scope and provide verified facts along with their level of certainty	Giving optimistic recovery estimates that communications turns into public promises
Legal / DPO	Assess notification obligations, deadlines, customer contracts and litigation risk	Blocking all communication out of fear of liability, leaving the narrative to others
Communications	Translate the facts into clear messages for each audience, manage media and channels	Getting ahead of the technical facts or using reassuring phrases that later turn out to be false
Executive leadership	Make decisions, act as spokesperson at key moments and protect overall consistency	Talking to customers or journalists independently without going through the crisis team
HR / Customer service	Deliver messages to staff and customers, and capture recurring questions	Improvising individual answers that differ from the official message

2.1. The golden rule: security provides the facts, communications chooses the words, leadership makes the call

No external message should go out unless the technical team confirms that every factual statement is correct, legal confirms it doesn't expose the company, and leadership signs off on it. It may sound bureaucratic, but with a rehearsed procedure this loop can be completed in under an hour. What can't happen is a statement saying "the incident is under control" because someone thought it sounded good.

3. Notification obligations: the legal clock starts ticking

This isn't a legal article, and every case should be reviewed by your legal counsel or your data protection officer, but no communications lead can manage a cyberattack without knowing, at least in broad strokes, the framework of obligations. Those obligations shape the timeline of all external communication.

When an incident affects personal data, the General Data Protection Regulation (GDPR) requires the data controller to notify the competent supervisory authority—in Spain, the Spanish Data Protection Agency (AEPD)—without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the notification can't be completed within that window with all the information, it can be provided in phases, with the reasons for the delay.

In addition, when the breach is likely to result in a high risk to the rights and freedoms of the affected individuals, the company must also inform them without undue delay, in clear and plain language, explaining the nature of the breach, its likely consequences, the measures taken and a contact point for more information.

1. Detection and awareness of the incident (hour 0)
   Document when and how the company became aware of the incident. That moment starts the clock, and the authority may ask for an explanation of it.
2. Initial risk assessment (first few hours)
   Security and legal determine whether personal data is involved, what kind (identifying, financial, health, credentials) and how many people could be affected.
3. Notification to the supervisory authority (within 72 hours)
   With the information available at that point, even if incomplete, and a commitment to supplement it. Communications needs to know the content so the public narrative is consistent.
4. Communication to affected individuals (if the risk is high)
   A direct, understandable message with practical recommendations. In practice, it's the most reputationally sensitive statement of the entire crisis.
5. Other notifications depending on the case
   A police report, alerts to public incident response teams, communication to business customers as agreed in contracts and, in certain sectors, additional obligations under cybersecurity rules for essential and important entities (NIS2) or from sector regulators.

In practice, the 72-hour deadline has an important side effect for communications: if you're going to notify an authority and possibly thousands of affected individuals, the information will end up being public. Planning communication as if everything you notify will become known is the only prudent assumption.

4. What to say and what not to say while the investigation is ongoing

The hardest phase of a cyberattack isn't the first hour—it's the days in between: the incident is already public, the forensic investigation is still underway and every audience demands answers that don't exist yet. A large part of the company's reputation is decided here. There are three cardinal sins in this phase: speculating, downplaying and blaming.

4.1. How to reframe the most dangerous phrases

Many of the phrases that damage a company's credibility during a cyberattack are said with good intentions: the goal is to reassure. The problem is that reassuring people with unverified claims means betting your reputation on the investigation confirming the best-case scenario. This table offers safer alternatives.

Risky phrase	Why it's dangerous	Recommended alternative
"No customer data was affected"	It may be contradicted by the investigation or by the attackers themselves	"At this time we have no evidence that customer data has been affected; the investigation is ongoing and we will inform you immediately if that changes"
"It was a highly sophisticated attack"	It sounds like an excuse and shifts responsibility	"We are analyzing how the access occurred in order to strengthen our defenses"
"Everything will be back up tomorrow"	If it doesn't happen, every day of delay becomes a new negative story	"We are restoring services in phases; we will update the status every day at 6:00 p.m."
"The failure was a vendor's fault"	Customers don't care whose fault it was: they trusted you with their data	"We are working with all our vendors to understand the scope of the incident"
"No comment"	It is read as a cover-up	"We can't share technical details while the investigation is ongoing, but we can share what we know so far"

The underlying principle is simple: it's better to say less, as long as everything you say is true, than to say a lot and have to walk it back. Every public correction costs more trust than the original negative information.

5. The ransom dilemma and how (not) to communicate it

In a ransomware attack, there's a question that sooner or later lands on the crisis team's table and, almost always, on a journalist's: will the company pay the ransom? It's a leadership decision that depends on technical, legal, ethical and business factors, and it should be made with specialist advice. Authorities and cybersecurity agencies generally advise against paying, among other reasons because payment doesn't guarantee data recovery or that the stolen copy will be destroyed, and because it funds further criminal activity.

From a strictly communications standpoint, the dilemma is twofold: what you decide and what you disclose. Each has different reputational consequences.

5.1. Possible communication positions

Position	When it makes sense	Reputational risk
State firmly that you will not pay	When the decision has been made and backups allow you to recover	Low, if true; it reinforces an image of strength. It may increase pressure from the attackers to leak data
Decline to comment on negotiations	While the decision is pending or a police investigation is underway	Medium; you need to explain why you're not commenting so it doesn't sound like a cover-up
Acknowledge payment after the fact	If you paid and it's likely to become known (or legal obligations require disclosure)	High, but lower than being found out. You need to explain the reasons and the measures taken

6. A message for every audience: customers, employees, suppliers, media and regulators

The same fact—"we've been hit by ransomware"—means very different things to each audience. Customers want to know whether their data is at risk and what they should do. Employees want to know whether they can work and whether their paycheck is at risk. Suppliers want to know whether they'll get paid and whether shared infrastructure is safe. Journalists want to know what happened and why. Regulators want to know whether obligations are being met. A single generic statement doesn't serve any of them well.

Audience	What they need to know	Recommended channel	When
Employees	What happened, what they can and can't do, where to route questions, what not to say externally	Meeting, direct message via an alternative channel, team leads	First, before anyone else
Affected customers	Whether their data is involved, specific risks, steps to protect themselves, a contact	Direct communication (email, letter, phone call for key accounts)	As soon as possible and always before they read about it in the press
Customers in general	Service status, whether they should be concerned, how to spot fraud attempts	Incident page on the website, social media, customer service	In the first few hours, with regular updates
Suppliers and partners	Impact on orders and payments, risks from connections to their systems, precautions against fraudulent emails	Direct contact from each relationship owner	Within the first 24 hours
Media	Verified facts, measures taken, an identified spokesperson	Official statement, single spokesperson	When the incident is public or about to become public
Regulators	Accurate and complete information according to their requirements	Official notification channels	Within legal deadlines

6.1. Employees: the front line and the first risk

Employees are both the most affected audience and the main leak channel. If they hear about the attack from the press, they'll feel ignored; if they don't have clear instructions, they'll share what they know in group chats, on LinkedIn or with customers. In a cyberattack they are also direct targets: attackers may try to trick them with emails impersonating the company.

• Explain what is known in non-technical language and acknowledge what isn't known yet
• Give clear operational instructions: which devices not to turn on, which tools to use in the meantime
• Warn about possible fraudulent emails, calls or messages impersonating the company
• Tell them where to route any questions from customers or journalists
• Ask for discretion and explain why, without a threatening tone
• If staff data is affected (payroll, ID numbers, bank accounts), treat employees as affected individuals with all their rights

6.2. Customers: the moment of truth

The message to affected customers carries the most weight for future trust. It should be direct, empathetic and useful: less "we apologize for any inconvenience" and more "here's what happened to your data and here's what we recommend you do." Offering concrete measures—a dedicated support channel, identity monitoring services when the type of data warrants it, a guide to spotting fraud attempts—shows that the company is taking ownership of the problem, not just reporting it.

If you operate in a heavily regulated or trust-sensitive industry such as banking or insurance, our in-depth analysis of online reputation in banking and insurance explores how that trust is built and lost. But the logic is universal: customers don't expect you never to be attacked; they expect that, if it happens, you'll treat them like adults.

6.3. Media: one spokesperson, one version

Cyberattacks increasingly interest mainstream media, not just the tech press. Appointing a single spokesperson, preparing a set of questions and answers and staying consistent with what has been notified are the bare minimum. If the case draws wide media attention, many of the guidelines in our guide on reputational crises in the media apply directly, with one caveat: here the journalist may have information obtained from the attackers themselves, so you should never assume they know less than you do.

7. Double extortion: when attackers threaten to leak your data

Modern ransomware rarely stops at encrypting systems. The dominant approach is double extortion: before encrypting, the attackers copy sensitive information and threaten to publish it on their sites if the company doesn't pay. Some groups add a third layer of pressure—contacting customers, employees or journalists directly, or launching denial-of-service attacks—to force payment.

From a communications standpoint, this completely changes the rules of the game: the company doesn't control the timeline. At any moment, a data sample may be published as "proof," along with a list of internal documents or screenshots of executive emails. And that publication can become a news story before the investigation has determined exactly what was taken.

7.1. How to prepare for a possible leak

1. Map what may have been taken
   Together with the forensic team, identify which repositories, folders or databases may have been copied, and classify them by sensitivity: personal data, commercial information, internal communications.
2. Prepare messages for each scenario
   Draft statements for three cases: publication of a sample, mass publication of customer data and publication of compromising internal documents. That way you won't be improvising under pressure.
3. Monitor leak sites and mentions
   With specialist support, watch ransomware group sites, forums and social media to detect the publication as soon as it happens. Solid online brand monitoring is a security tool here, not just a marketing one.
4. Notify affected people before anyone else
   If a group's data is about to appear or has already appeared, they should hear it from the company—not from a journalist or from an email sent by the criminals themselves.
5. Warn about follow-on fraud
   Leaked data fuels phishing and impersonation campaigns. Explain to customers and employees how to spot fraudulent messages that use that information.
6. Act on the spread
   With legal advice, request the removal of content reproducing personal data on legitimate platforms and assess measures to limit the indexing of that data.

8. Templates: initial statement and update statement

No template replaces the crisis team's judgment, but having a draft already written and pre-approved by legal saves hours at the most critical moment. These two short structures are a starting point for most companies; always adapt them to the verified facts of your case.

If you'd like a broader set—short, medium and long versions, internal statements and sample social media replies—you can download our crisis statement templates right from this article. They include scenarios that apply to cybersecurity incidents.

9. Channels and update cadence

In a cyberattack, the channel also sends a message. And there's an added difficulty: your website, email or customer service platform may be down or compromised. That's why you need to plan alternative channels and define, from the outset, an update cadence that gives every audience predictability.

9.1. Cadence as an antidote to anxiety

Committing to update at a fixed time—say, every day at 6:00 p.m.—even when there isn't much news has an enormously calming effect. It reduces pressure on customer service, limits speculation and shows that the company is in control of the process even if it doesn't yet control all the facts. An update that says "we are still restoring systems, with no significant changes since yesterday" is far better than silence.

10. After the attack: transparency about the measures taken

Getting systems back up doesn't mean the crisis is over. For customers and partners, the question shifts from "what happened?" to "why should I trust you again?" The answer isn't a PR message; it's showing, through action, what has changed.

1. Closing statement
   Explain what happened (at the level of detail security allows), what data was ultimately affected, what the consequences were and what has been done for the people affected.
2. Concrete, verifiable measures
   Not "we have strengthened our security," but "we have rolled out multi-factor authentication on all access points, segmented the network and hired a 24/7 monitoring service." Specificity is what builds credibility.
3. Lessons learned, with humility
   Acknowledging what didn't work in the response, including in communication, reinforces the perception of seriousness. The companies that come out best are the ones that don't pretend they did everything right.
4. Follow-up with affected people
   Keep the support channel open for weeks and communicate any relevant developments, such as new fraud attempts using the leaked data.
5. Reputation rebuilding
   Review what comes up when people search for your brand together with "cyberattack," "hack" or "data leak," and work to make sure the full story—including your response and the improvements—is what customers and search engines find.

This post-incident work has a lot in common with any effort to rebuild your reputation after a crisis: it takes consistency, alignment between what you say and what you do, and patience. Trust lost in a day takes months to win back, but it does come back when customers see that the company has learned.

11. Preparing before an attack: checklist and conclusions

Most communication mistakes in a cyberattack aren't caused by a lack of talent but by a lack of preparation. When the attack hits, it's too late to decide who sits on the crisis team, who signs off on a statement or how to reach staff if email is down. This checklist sums up the minimum every company should have settled in advance.

• A cyberattack-specific annex within the crisis communication protocol
• A defined crisis team with primary and backup members from IT, legal, communications and leadership
• An out-of-band coordination channel and a contact list accessible without corporate systems
• An internal procedure for breach assessment and 72-hour notification, known to the communications team
• Pre-approved templates: initial statement, update, notice to affected people, message to employees and to suppliers
• A designated spokesperson trained to handle tough questions about ransoms, data and accountability
• An incident page ready to be activated on independent hosting
• An inventory of sensitive data and internal documents whose theft would be especially damaging
• Pre-arranged agreements with incident response and crisis communication specialists
• At least one annual drill that includes the communication side, not just the technical side

11.1. Conclusions

No company can guarantee it will never suffer a cyberattack. What it can guarantee is how it will respond when one happens. And that response, more than the attack itself, is what will determine whether customers stay or leave. Trust doesn't break because a criminal group managed to get into your systems; it breaks when customers feel you hid information from them, downplayed a real risk or tried to blame someone else.

The companies that come out of a ransomware attack stronger share a pattern: they communicated early, honestly separated what they knew from what they didn't, met their legal obligations without hiding behind them, took care of their employees and the people affected first, and then proved through action what had changed. It's not a magic formula, but it is a method. And like any method, it works much better if it's been rehearsed before you need it.

If you want to know how prepared your company is to communicate a cybersecurity incident—and what a customer or journalist would find today by searching your brand alongside the word "cyberattack"—we can help you review your protocol, your messaging and your digital exposure. Our crisis management service works precisely in that space.

12. Frequently asked questions