When You Can’t Control the Story: Transparency in a Cyber Crisis

There is a moment in every serious cyber incident that communications teams rarely talk about. It is the moment you realise the story is already being written elsewhere; and the author does not have your best interests in mind. 

Imagine that someone has posted a countdown on a dark-web leak site. A researcher on the other side of the world is narrating your outage to fifteen thousand followers. Your own staff are comparing notes in a group chat that no policy reaches. Somewhere in a “war room”, a comms lead is still waiting for legal to bless the first sentence of a holding statement that the internet decided it no longer needed twenty minutes ago.

That moment is the whole problem in miniature. The technical detail of a cyber incident is genuinely hard, but it is not the hard part for communications. The hard part is the oldest one in the business: Holding on to trust while the organisation is under pressure and the ground is moving beneath it. What has changed is not the challenge. It is the physics of the environment in which the challenge now plays out, one where information travels instantly and arrives often without context. Are you ready for this?

In that environment, transparency has stopped being a matter of tone. It is the only strategy that survives contact with reality.

The first to know

In a cyber incident, the victim is rarely the first party to understand what has happened to them. Threat actors publish stolen data on public leak sites, often before an organisation has finished confirming the intrusion internally. Those claims are then indexed and made searchable by public trackers such as ransomware.live — an open, continuously updated register that lists ransomware victims and the data their attackers say they hold, scraped straight from the criminal leak sites themselves. It surfaces a named victim within hours, sometimes before that organisation has confirmed the breach to itself. Go and look, because your customers, your regulators and your competitors already have. Security researchers reverse-engineer the anomaly while your IT team is still scoping it. Customers notice the outage before anyone has named a cause. Employees form their own conclusions in channels you cannot see.

In a cyber incident, the victim is rarely the first party to understand what has happened to them.

This is why “hold until we know everything” has quietly become the most dangerous instinct in the room. It sounds prudent. It feels defensible. But by the time the flawless statement is signed off, the narrative has already set elsewhere, and every word you eventually publish is now read as a correction rather than a lead. The organisation has to operate as though it is one voice among many. That is not a failure of preparation. It is the new baseline.

Silence is not neutral

When an organisation says nothing, people do not wait politely. They fill the gap, and the material they fill it with moves inexorably towards the worst case. Even well-meant silence can and will be misinterpreted as guilt.

Equifax is the case study that refuses to age. In 2017, attackers moved through its systems for seventy-six days before anyone noticed. The company knew internally by late July and did not tell the public until 7 September; roughly six weeks of chosen silence, justified at the time as the responsible need to establish scope. During that window, three senior executives sold close to $1.8 million in stock. When disclosure finally came, the consumer site set up to let 147 million people check their exposure was hosted off Equifax’s own domain, carried a flawed security implementation, and reportedly returned near-random results. The bill ran past a billion dollars once settlements, litigation and remediation were counted. The CEO, CIO and CSO all left.

None of that was the breach. The breach was a missed patch (software maintenance procedure). Everything expensive that followed was a communications and accountability failure wearing a cybersecurity costume. The lesson is not that Equifax was careless with a server. It is that the silence became the crisis.

Transparency is the antidote, but it is worth being precise about what it means. It does not mean releasing every technical detail the moment you have it. It means refusing to leave a vacuum, because misinformation will fill the void.

Honesty is credibility, especially when the news is bad

Audiences are more cyber-literate than most organisations give them credit for, even when they cannot articulate it. They already know breaches happen, systems fail, and capable attackers are patient and everywhere. What they will not forgive is being managed. Vague language, minimisation, the passive voice deployed to smother an admission; these are the tells they now read instantly, and they cost you more than the bad news ever would.

Vague language, minimisation, the passive voice deployed to smother an admission; these are the tells they [audience] now read instantly, and they cost you more than the bad news ever would.

The 2025 attacks on UK retail make the point better than any framework. Marks & Spencer and the Co-op were hit by the same adversary using near-identical social engineering, and the outcomes diverged sharply. The Co-Op’s security team spotted the anomalous account behaviour and shut it down inside the hour, containing what could have been catastrophic. M&S lost online sales for roughly six weeks and took an estimated £300 million hit to profit, with the initial foothold reportedly coming through a hijacked account belonging to a third-party.

Here is the part that matters, and it is more useful than a tidy hero story. Neither handled the communications flawlessly. M&S was proactive with the market but took close to three weeks to notify customers directly, and drew criticism for how little it said about scope. The Co-Op contained the intrusion brilliantly yet was slower and more reactive with its own members, briefing the press before the people whose data had actually been exposed. Both got parts of the timeline wrong under genuine pressure.

However, both still came through it with their reputations broadly intact. Why? Because neither reached for the Equifax playbook. Neither tried to make the story disappear. The instructive contrast is not flawless versus botched; it is owned versus buried. Organisations that lead with clarity, are read as mature. Organisations that reach for the shadows are read, eventually and permanently, as guilty.

Transparency is not an act of courage

None of this works as improvisation. The open response that looks so calm from the outside is almost always the product of decisions made months earlier, when nothing was on fire.

That discipline has a recognisable shape. Messaging frameworks agreed and pressure-tested before they are needed, so the first words out are not the first draft. Technical, legal and communications functions rehearsed together until they trust each other’s judgement at speed, rather than meeting for the first time at 2am. A single authoritative source of truth, so the organisation never contradicts itself in public. A predictable cadence of updates, so silence between them is never mistaken for a new problem.

This is the same muscle that separated the retailers response from Equifax’s, years and an ocean apart. One had rehearsed the reflex. The other was inventing it live. Or put more simply: You don’t rise to the occasion; you fall to your level of preparedness.

Not a trend. An expectation.

Regulators now write the timeline for you regardless: the GDPR’s seventy-two-hour clock does not pause while you decide whether you feel ready. Customers assume openness as a baseline. The public treats a straight answer under fire as evidence of good governance, and its absence as evidence of the opposite. Cyber incidents are no longer rare or exotic; they are a standing condition of operating at all. Transparency has quietly moved from something you manage as a risk to something you are simply expected to demonstrate.

In a cyber crisis, the one thing you cannot decide is whether the information becomes public. That decision has already been made; by the threat actor. The only decision left to you is whether you lead with clarity or spend the next eighteen months reacting to a story someone else finished writing.

Transparency is the anchor. Everything else in a cyber crisis is in motion. The anchor is the one thing that keeps you from being dragged wherever the current decides to take you.

---

Author: Barri-Jon Graham is the Co-Founder of ArcaSecure UK which is a cyber-security and governance consultancy. He has over 20 years’ experience in security and intelligence and has led on cyber strategy and operational resilience initiatives across public and private sectors, including critical national infrastructure. www.arcasecure.co.uk

Image: AI generated