When a breach goes public, the company has to say something on a tight clock — and the wrong words do lasting damage. This kit gives you the holding statement, the customer and staff notifications, the spokesperson matrix, and a "never say" list with a correction protocol, so you communicate early and honestly without promising what you cannot verify.
Educational template — not legal or PR advice. Breach-notification duties vary and change; align the timing, content and sequencing of every notice with qualified counsel.
Free · no signup · adapt it in your own doc
Breach Crisis Communications Kit
A ready-to-adapt set of breach-communication templates: the first holding statement, the customer/affected-individual notification, the internal all-staff note, the press and stakeholder Q&A with a spokesperson matrix, and a "never say" list and correction protocol. Draft early, approve with counsel, and keep every message consistent with your filings and notification duties.
01Holding statement (first 1–2 hours — no speculation)
A short, factual statement that acknowledges the situation and buys time, without committing to a cause, scope or any promise you cannot yet verify. Use it the moment inquiries start. Say only what you actually know.
Acknowledgement
We are aware of a security incident affecting some of our systems and are investigating it as a priority.
What you are doing
We have engaged security experts, are taking steps to secure our environment, and have notified the relevant authorities where required.
What you know — only confirmed facts
State only what is established; if the scope is not yet known, say the investigation is ongoing
Commitment to update
We will provide further updates as our investigation progresses and we are able to confirm more.
Where to go for help / questions
Dedicated page, support contact or media contact
Do NOT speculate on cause, attribution or scope, and do NOT promise "your data is safe", "no data was accessed" or "fully contained" before forensics confirms it. An assurance you later retract is more damaging than saying the investigation is ongoing.
Plain-language, empathy-plus-action. Send it to those actually affected, on the timeline and with the content your legal duties require — not a blanket "just in case" blast to everyone. Lead with what happened and what it means for them, then exactly what you are doing and what they should do.
Subject line
Important security notice about your account
What happened
Plain-language description of the incident, at the level you can confirm
What information was involved
The specific data types affected for this person — or that this is still being determined
Reset password, enable MFA, watch statements, how to reach us — concrete steps
Support / resources offered
Credit monitoring, dedicated helpline, FAQ page, if applicable
Contact for questions
Named channel staffed to respond
Avoid dense legalese and avoid centring the company’s own distress. Acknowledge the impact on the recipient, be specific, and give usable next steps. Confirm the required timing and mandated content with counsel before sending.
03Internal all-staff note
Employees should not learn about their own company’s breach from the news. Brief staff — at a high level — before or in lockstep with the public statement, and give them the holding line plus where to send every inquiry.
What we can tell you
High-level summary of the situation, consistent with the public statement
What this means for your work
Any operational changes, password resets, systems offline
The one approved holding line
The exact wording staff may repeat if asked
Where to direct all inquiries
Media → comms; customers → support script; regulators/legal → GC — a single routing
Do NOT post about the incident on personal or social accounts
Do NOT answer press, analyst or customer questions directly — route them to the named owner
Direct all media inquiries to the designated spokesperson only
Report anything you see circulating externally (rumors, leaks) to the comms lead
A blindsided workforce is your biggest leak risk and produces a thousand off-message spokespeople. One routing and one holding line keep staff aligned without disclosing more than is ready.
04Press / stakeholder Q&A + spokesperson matrix
War-game the predictable hard questions with counsel before anyone faces a mic, and assign a single owner, channel and timing to every audience so the message stays consistent and no one you owe a direct notice hears it first from the news.
Audience
Channel
Owner
Timing
Affected customers / individuals
Direct email + dedicated page
Comms + Support, approved by GC
On the legally required timeline
Regulators / data-protection authorities
Formal notification per statute
General Counsel
Within the mandated deadline
Employees
All-staff note / town hall
CEO / HR / Comms
Before or with the public statement
Press / media
Statement + designated spokesperson
Head of Comms (sole spokesperson)
Coordinated with filings
Investors / markets (if public)
8-K / IR statement
CFO / IR, with GC
Per securities-filing duties
Partners / key customers (B2B)
Account-manager briefing
Named account owners
With or just after public notice
Prepared holding answers to the questions you will be asked:
"Was customer data stolen?"
Here is what we can confirm; the full scope is still under investigation — do not give an absolute "no" you cannot back
"Did you pay the ransom?"
Pre-agreed line cleared with legal and law enforcement — do not improvise
"Whose fault was it / was it a vendor?"
The investigation into root cause is ongoing; we will not speculate or assign blame before the facts are established
"How many people are affected?"
Preliminary figure clearly labelled preliminary, consistent with filings — or that it is still being determined
One designated spokesperson and one source of truth. Everyone else routes inquiries there. Keep the public statement, the 8-K and the breach notices telling one consistent story.
05"Never say" list + correction protocol
Phrases to keep out of every statement until the facts support them — each one becomes a quote you may have to retract:
"Your data is completely safe" / "no data was accessed" — before forensics confirms it
"The incident is fully contained" — before containment is verified
"This was a sophisticated attack by [actor]" — attribution before evidence
"It was our vendor’s / [named employee’s] fault" — blame before root cause is proven
"We expect no impact" / any absolute guarantee about outcome
Dense legalese in place of plain-language empathy and concrete next steps
Specific technical detail (vulnerabilities, IOCs) that would impede response
Correction protocol — when an earlier statement turns out to be wrong:
Act promptly once you know the earlier statement was inaccurate — do not wait and hope no one notices.
Be transparent: state that the earlier information was incorrect, give the corrected facts, and explain how the picture changed.
Do NOT quietly edit or delete the original — an exposed quiet scrub reads as a cover-up and is more damaging than the error.
Issue the correction through the same channel and spokesperson, consistent with your filings and notices.
Log the correction and the decision trail; coordinate with legal before it goes out.
Educational template — not legal or PR advice. Breach communications sit on top of real notification duties (state, sector and international) that vary and change. Align the timing, content and sequencing of every notice with qualified counsel and your specific regulatory obligations.
Practice the decision
This kit records calls you can rehearse. The free Crisis Comms / Holding Statement Lab puts you in the war room and grades you on ~14 of the exact decisions these templates support — hold statement or stay silent, what to promise, who speaks, how to sequence the notifications, and how to correct a wrong statement.
TL;DR
What this template is
A ready-to-adapt kit of breach-communication templates: the first holding statement, the customer/affected-individual notification email, the internal all-staff note, a press and stakeholder Q&A with a spokesperson matrix, and a "never say" list with a correction protocol.
Built around the discipline that holds trust: say something early without speculating, never promise what you cannot verify, keep one spokesperson and one source of truth, sequence the audiences, and correct a wrong statement promptly and openly.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Crisis Comms / Holding Statement Lab.
Educational template — not legal or PR advice. Use it with qualified counsel and your notification duties.
Frequently asked questions
What is in this kit?+
Five templates for communicating during a live breach: a first-hour holding statement that acknowledges without speculating, a plain-language customer notification email, an internal all-staff note so employees are not blindsided, a press and stakeholder Q&A with a spokesperson matrix (audience, channel, owner, timing), and a "never say" list paired with a protocol for correcting an inaccurate early statement.
What should the first holding statement say?+
That you are aware of an incident, are investigating it as a priority and taking it seriously, and will update as you learn more — plus only the facts you can actually confirm. It should NOT guess at cause, scope or attribution, and should not promise "your data is safe" or "fully contained" before forensics confirms it.
In what order should audiences be notified?+
Sequence deliberately: meet the legal duties to regulators and affected individuals on their required timelines, brief employees so they are not blindsided, and coordinate the broad public/press statement so no audience you owe a direct notice learns of their own exposure from the news. The spokesperson matrix in the kit lays this out.
Is this legal advice?+
No. It is an educational template. Breach-notification duties vary by jurisdiction and sector and change over time, and your public statements interact with securities and regulatory filings. Confirm the timing, content and sequencing of every notice with qualified counsel and apply them to your specific facts.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout