The crisis statement that never says sorry or who is affected

The release, faults marked

FOR IMMEDIATE RELEASE A Statement Regarding a Recent Technical Matter Impacting Certain Systems¹ Halvern Retail Group takes the security of its systems very seriously and is committed to maintaining the trust of its valued customers, partners and stakeholders at every step of its ongoing operations. It has come to the company's attention that certain systems may have experienced unauthorized access² during a recent period, and an investigation into the matter is currently underway with the assistance of outside experts. Mistakes were made in how quickly the issue was identified, and lessons will be learned going forward.³ It is believed that some information may have been involved, though the full scope is still being assessed and additional details will be shared if and when they become available. The company cannot yet confirm which customers, if any, were affected.⁴ "We understand that situations like this can be concerning, and we want to reassure everyone that this matter is being taken seriously at the highest levels,⁵" said a Halvern Retail Group spokesperson. Additional information will be made available as the investigation continues, and the company asks for patience as it works through the details with the outside experts it has engaged. Customers who have questions in the meantime are encouraged to review the company's general privacy policy on its website. The company remains focused on its mission of delivering value to customers⁶ and will continue to invest in its security posture as part of its ongoing commitment to excellence.

What is wrong, and the fix

1. 1

   The headline avoids saying what happened, using a vague phrase like technical matter instead of naming the incident.

   Say plainly what happened, for example a data breach or a service outage.

2. 2

   Passive voice hides who is responsible and delays the actual news past the opening paragraph.

   Use active voice and state directly what happened and when it was discovered.

3. 3

   Passive voice again avoids naming who made the mistake or taking direct responsibility for it.

   Replace with a direct sentence such as we should have caught this sooner, and we are changing how we monitor for it.

4. 4

   A crisis statement must say who is affected, even in general terms; this sentence avoids the question entirely.

   State who is affected as specifically as is currently known, such as by region or account type.

5. 5

   This is not an apology and does not take responsibility; it reassures without ever saying sorry.

   State a plain apology, such as we are sorry this happened, before anything else.

6. 6

   The statement ends with marketing language instead of saying where people can find updates.

   End with exactly where and how updates will be posted, and a contact for questions.