A confidential announcement leaks: organising the first hours

Verify the material without spreading it further

A screenshot may show an old draft, an incomplete document, a fabrication or genuine information without context. Preserve the link, time and necessary evidence through authorised channels, then have the content assessed by the appropriate people. Broad internal forwarding can worsen the exposure. Security and legal specialists should determine how evidence is preserved.

Maintain a situation log that separates observations, sources, confidence levels and verification owners. Repeated claims should not become accepted facts simply because they appear in several meetings. Identify the people, activities and information potentially affected. Transaction details, employee plans and personal data may trigger different response tracks.

Establish a team with actual decision-making authority

Start with a decision owner, communications, legal and the directly affected functions. Add security, the data protection officer, HR or investor relations according to the incident. Name deputies for indispensable approvals. Make the response deadline and escalation path explicit: silence from an approver must not be interpreted as consent.

Organise work around facts, protection, obligations and communication. An external statement should not claim that an incident has ended while operational investigation continues. Record decisions, their rationale and the new information that would require them to be reconsidered.

For an international group, establish a local contact who can obtain facts and convene the required French expertise. Pre-agreed escalation arrangements are more useful than a generic instruction to wait for headquarters. They must still respect the authority of the people responsible for each decision.

Separate public communication from required notifications

Where personal data is involved, the controller and data protection specialists assess the relevant obligations. The CNIL describes personal-data breach notification requirements, including the 72-hour deadline where notification to the authority is required. This does not mean protective action can wait until that deadline.

Financial disclosure, contractual notice and information to affected people also have distinct purposes. A press release does not establish that every obligation has been fulfilled. Maintain a record of recipients, responsible functions, required content and verified deadlines. Do not assume a parent company’s process satisfies the subsidiary’s duties automatically.

Write a holding statement that remains factual

A holding response can state the verified scope, measures or checks underway and how further information will be provided. Avoid unsupported denial, speculation about the source and promises about investigation results. Only announce a future update time if the team can honour it, even if the update is that work continues.

An illustrative structure is: the organisation has become aware of the material; competent teams are checking its authenticity and context; confirmed information relevant to affected people will be communicated through appropriate channels. Every element must be true before use. If there is a confirmed danger or a duty to provide specific information, this general structure will not be sufficient.

Equip exposed teams and review the response

Managers, customer teams and spokespeople need a short response, a clear limit and a channel for questions. When facts change, withdraw obsolete answers as explicitly as new ones are issued. Translation should preserve uncertainty rather than make a provisional statement sound final.

After the acute phase, review factual circulation, decision delays, contradictory statements and consequences for affected people. This operational review complements any investigation into the source. Crisis preparation and an announcement checklist can test the process before it is needed.