Matt Earle is an entrepreneur based in Toronto, Canada, and is the President of Reputation.ca, an online reputation management company.
getty
Data breaches are a problematic fact of life in our digital era of commerce. No matter how good your security is, human error or malicious compromise can result in a breach of that security. And it’s impossible to protect a system entirely.
The hours, days and weeks afterward are absolutely critical if your company suffers a data breach. Properly handling a breach allows you to emerge from the crisis in a good position. Conversely, poorly handling the data breach can tank your reputation and cause irreparable damage.
Be transparent.
Transparency is critical. Customers and clients need to know if their data has been compromised so they can take any necessary actions to protect themselves. If you delay, issue inconclusive statements or downplay the severity of a breach, it will likely be discovered sooner rather than later and devastate your reputation.
Every U.S. state and most countries have laws requiring disclosure of data breaches, though those laws vary from location to location. It’s worth knowing which jurisdiction you fall under and what rules apply.
MORE FOR YOU
Work to identify affected data, uncover the scope and scale of the breach, and determine what, if anything, is usable from the data that has been breached. A breach of an encrypted database may not be valuable for the hackers or risk exposing personal information. A breach of otherwise public data may not be severe either. However, a leak of recorded customer personal information can be dangerous.
Determine the groups of customers affected by the breach, what information may be breached, and disclose that scope. This process helps facilitate those customers’ protection, whether that be changing passwords, canceling credit cards or enrolling in identity theft protection.
Be proactive.
Be proactive in issuing statements, helping customers resolve any concerns they may have and communicating with them. When a breach happens, you can expect a deluge of calls and emails about it. You may need to scale up your customer service team to handle the scope of contact.
At the same time, you will likely need to invest proactively in advertisement and messaging. Your competitors may try to take advantage of this vulnerable moment to poach your customers, and you need to be proactive in countering their attempts.
You will also need to be proactive in repairing and enhancing your security, patching software, issuing employee training, tightening data security and enacting policies to help prevent this from happening again. If intruders can get in once, you need to identify how they did it and take steps to prevent it from happening again.
Work with experts and authorities.
Part of transparency and recovery is working with the relevant authorities and experts to track the scope of the breach. A post-mortem analysis can be critical. For one thing, it can determine what data was stolen, by who and how. It can also help track where that data ends up and how it is used.
In cases where the cause has something to do with software or hardware being exploited, it can be essential to inform the developers or manufacturers of the breach and how it occurred. They may also need to issue patches or recalls to prevent other businesses using that hardware or software from being compromised. No business stands alone.
In addition to post-mortem analysis and recovery, you may be able to invest more heavily in security, infrastructure and training to prevent future occurrences.
Work on reputation management.
Recovery after a breach is a sensitive time. You will undoubtedly see a deluge of negative reviews and bad press, which will be difficult to counteract. Clear and transparent messaging is part of it; breaches happen, and there’s no surefire way to avoid them. Demonstrating that your data security policies prevented usable data from being stolen or that you’ve been able to protect users proactively can be critical to repairing your reputation.
Your post-breach messaging will also be an essential part of building up a reputation. When someone has a concern about a past breach, you need to be able to demonstrate tangible changes you have made to keep them safe. Whether you handle your reputation management on your own or hire a firm to manage it for you, it will need to happen if you want your company to recover.
Avoid common mistakes.
It can be tempting to take shortcuts to recover from a breach, but there are many mistakes you need to avoid making.
First, never pay a ransom for your data. Data ransoms fuel the hacking industry, and paying off a hacker to keep quiet never works. Never delay in notifying and disclosing a breach. Delays make recovery worse for everyone involved, including both your business as a whole and your customers. Finally, if you haven’t been breached yet, don’t assume you’ll never be hit. Develop an incident response plan now before it’s too late.
Forbes Agency Council is an invitation-only community for executives in successful public relations, media strategy, creative and advertising agencies. Do I qualify?
Go to Source
Author: Matthew Earle, Forbes Councils Member
