Words Are a Product Decision
When a company communicates publicly about an incident, the statement is not just a PR exercise — it is a signal to customers, regulators, investors, and employees about the company's character and competence. The wrong statement can turn a recoverable incident into a permanent reputational wound.
There are four recognizable archetypes of public crisis communication. Three are failures. One works.
Archetype 1: The Non-Apology (Worst)
"We apologize for any inconvenience this may have caused."
The words "any" and "may have" do all the damage. "Any inconvenience" minimizes the harm — a breach exposing your customers' personal data is not an "inconvenience." "May have caused" implies the company isn't sure it did anything wrong. This phrasing is so universally recognized as evasive that it now actively increases customer anger rather than defusing it. Customers have learned to read it as: "We are legally required to say something, but we don't actually think we did anything wrong."
Archetype 2: The Passive Voice Victim (Weak)
"A configuration error occurred, resulting in a service disruption."
This construction — beloved by legal teams because it avoids assigning agency — makes the company sound like a passive bystander to its own failure. "A configuration error occurred" implies the error materialized from thin air, unconnected to any human decision. Customers and journalists immediately ask: "Who made the error? Why didn't you catch it? Are you in control of your own systems?" Passive voice signals incompetence, not caution.
Archetype 3: The Blame Deflection (Dishonest)
"We were the victim of a sophisticated, nation-state-level cyberattack that no organization could have prevented."
This archetype attempts to reframe the company as a victim rather than a responsible party. It is occasionally true — but it is deployed so frequently in cases where the breach was caused by an unpatched server or a reused password that it has become a credibility signal in reverse. When customers hear "sophisticated attack," they now assume the company is hiding a basic failure. If the attack genuinely was sophisticated, the forensic evidence will eventually make that clear. Claiming it upfront, before the investigation is complete, looks like spin.
Archetype 4: Extreme Ownership (Correct)
"We failed to meet the standard our customers deserve. On [date], a misconfiguration in our firewall allowed unauthorized access to a database containing customer email addresses. We are deeply sorry. Here is exactly what happened, what we have done to stop it, and what we are changing so it cannot happen again."
This archetype works because it does four things simultaneously:
- Owns the failure without hedging ("We failed").
- States the specific technical fact ("misconfiguration in our firewall") — which demonstrates competence and transparency, not weakness.
- Expresses genuine regret without legal weasel words.
- Demonstrates forward control ("here is what we are changing") — which is the most trust-rebuilding element of all.
The counterintuitive insight: customers and the public are far more forgiving of companies that own their mistakes clearly than companies that evade. The evasion is what destroys trust permanently. The mistake itself is often forgiven.
The legal tension: Legal teams often push back on Archetype 4 because specific admissions ("misconfiguration in our firewall") can be used in litigation. The resolution is to have legal review the specific technical facts stated — not to remove them, but to ensure they are accurate and don't inadvertently admit a legal standard (like negligence). Accurate technical facts, stated clearly, are defensible. Vague evasions that are later contradicted by evidence are not.