Ransomware crisis communications when your usual systems are unavailable
A cyber incident response must help affected people act even when normal email and business tools cannot be trusted. Communications connects technical evidence, management decisions and practical information.
Establish a usable decision process
Connect the communications lead with incident response, management, legal and privacy teams. Agree a backup channel approved by security and maintain a timed record. An outage does not prove either data theft or the absence of compromise. Preserve the confidence level of every statement. ANSSI and CISA guidance both address preparing communications alongside incident response.
Give each audience something useful
The first update identifies affected services, confirmed alternatives, safe contacts and the next update. Employees, customers and partners need different instructions. Avoid unsupported recovery promises or categorical assurances about data before the investigation supports them. Regulatory reporting and direct notification require their own assessment; a press release is not a substitute.
Illustrative scenario: a services company
A provider cannot process some customer requests. An independently accessible status page and a verified phone channel provide direction. Sales teams receive the same facts about available operations, suspended services and recorded requests. Journalists are given consistent information without technical details that could undermine response. This is a planning scenario, not a reported client incident.
Explain recovery in stages
Before declaring normal service, verify what has actually been restored, which checks are complete and what restrictions remain. Retain message versions to identify and correct discrepancies. Review unanswered questions, failed channels and premature announcements, rather than treating media volume as a performance measure. For US or UK groups operating in France, assign local notification decisions to qualified advisers instead of assuming a single global deadline.
Sources and further reading
Explore further
Crisis communications: ten situations, ten responses
Practical analysis for initial decisions, information for affected people and follow-through on commitments.
Reputation & crisis
Build a coherent response when facts, expectations and decisions move quickly.
Prepare for our first conversation
A short introduction is enough to start: your organisation, the decision at hand, the audiences involved and your deadline. Confidential documents can follow through an agreed channel.
From insight to action
Reputation & crisis management
Build a coherent response when facts, expectations and decisions move quickly.
Technology, AI and cybersecurity
Technology earns credibility when people understand what it can do, what it cannot do and who is accountable.
Sensitive announcement: a readiness checklist
An announcement is ready when the facts, responsibilities and response arrangements are clear.
Prepare your crisis response
A short introduction is enough to start: your organisation, the decision at hand, the audiences involved and your deadline. Confidential documents can follow through an agreed channel.
Email Belief System