Who Hears What, and in What Order
One of the most operationally damaging mistakes during a crisis is communicating to the wrong audience at the wrong time. Employees finding out about a breach from a news article, or regulators learning about an incident from a customer tweet, are both failures of sequencing — and both make the crisis significantly worse.
The correct communication sequence follows a strict priority order:
1. Internal Incident Command (Immediate)
The incident response team, engineering leadership, and legal counsel are notified first. No external communication happens until this group has a shared understanding of the facts.
2. Regulators (Within Legal Deadlines)
Regulatory notifications (GDPR 72-hour, financial regulator reporting) happen before public disclosure. Regulators expect to hear from you before they read about it in the press. Notifying a regulator after a news story breaks is treated as an aggravating factor.
3. Affected Customers (Direct, Before Public)
Customers whose data was specifically affected should receive direct notification (email, in-app message) before or simultaneously with the public statement — never after. Learning about your own data breach from a news article is a trust-destroying experience that customers remember for years.
4. Employees (Before or Simultaneously with Public)
Employees should not learn about a major incident from external media. An internal communication — even a brief one saying "here is what we know, here is what we are doing, more to follow" — prevents the morale damage of employees feeling uninformed about their own company's crisis.
5. Public Statement (After the Above)
The public statement, press release, or blog post is the last step — not the first. It should be published only after regulators have been notified, affected customers have been contacted, and employees have been briefed.
6. Media Inquiries (Reactive, Controlled)
Proactive press outreach is rarely the right move during an active incident. Designate a single spokesperson. All media inquiries are routed through PR. Engineers and individual contributors do not speak to journalists without explicit authorization.