Whether the impact of a breach on a brand will be disastrous or positive depends on some critical decisions made at the outset.
Bringing the RedPhone team in at the start significantly increases the chances of a positive outcome. Here are two examples that highlight this:
Proof Point One
the bad
In 2019, a global HR platform discovered and disclosed a breach, the consequences of which potentially impacted government agencies and some of the world’s largest and best known businesses, academic institutions and not-for-profits. Tens of millions of individual consumer records were at risk.
By the time we were called in, the breached company had panicked and had already started drip-feeding information to various clients causing a cascade of confusing and uneven notifications. Not only that, the company had seized on a flimsy early forensic finding that they chose to blame for the breach. The result was chaos: baffled journalists and a sudden loss of trust among stakeholders, many of whom were reluctantly forced to activate notification protocols.
Even though we were engaged too late in the communications cycle, we managed to stop the haemorrhaging by unifying communications around defensible positions, stopping confusing leaks of contradictory forensic findings, and rebuilding confidence in key partners. While damage was done, we were able to prevent further damage by lowering the temperature around the incident and right-sizing the magnitude of the breach in the media.
This case is our touchpoint for why it is necessary to engage Redphone early, ideally even before a breach has occurred.
Proof point two
The good
In 2017, a well-known company’s database was illegally accessed. The incident potentially exposed hundreds of thousands of customer records.
Engaged from the start, we oversaw an operation that neutralised the hacker, protected the records, and orchestrated a comprehensive communications and notification strategy that delivered a consistent and cohesive message through all stages. The end result was minimal – if any – damage to the company’s reputation. Within a month, the NPS score was higher than before and fewer than ten individual complaints to government were recorded out of two hundred thousand potentially affected consumers.
This response is now widely cited as ‘best-practice’.