Public relations. Neutralizing potential reputational impact from cyber incidents
- Not all companies measure the impact of reputation on business continuity. However, the volume of sales, the rate of organizational growth, and relationships with regulators are all directly dependent on the image of the brand. A ruined reputation can lead to serious disruptions in these processes and cause enormous losses.
- Analyzing company activities can help identify events that are critical to its reputation.
- A business impact analysis (BIA) allows a company to measure the potential damage to its reputation in case of a cyber incident and tailor its defenses accordingly.
- To avoid reputational damage, an emergency action plan should be prepared and communicated across the board: in the event of a cyber incident, each employee must know their role and senior management should be able to quickly address the issues.
Reputation can take years to build and just moments to lose. A strong brand is a valuable asset for companies to develop and become more competitive. Thus, they tend to invest a lot of time and resources in building a name for themselves. An undermined reputation creates risks to businesses: from a loss of trust with customers and partners to major financial damage. Despite this, few companies assess the impact of reputation on business continuity.
In the digital age, information travels fast and reaches a huge audience, making brand reputation particularly vulnerable. On the one hand, this allows businesses to grow rapidly. On the other hand, when an incident occurs, the media and bloggers respond instantly, which may often leave a lasting stain on the brand.
For example, consider a tech support failure at a digital services company. Users who all of a sudden lost access to their familiar content quickly take to the Internet to share their disdain. A blogger whose request is not addressed in time can speak out against the company on their social networks, and a barrage of criticism from the blogger’s followers will immediately descend on the organization. The result is a tarnished reputation.
Cyber incidents pose a serious threat to brand reputation. They are the most likely cause of adverse events that harm the brand. On top of that, cyberattacks against organizations are becoming more numerous. In 2022, their number increased 38% globally
We will share tips and provide practical advice on how to mitigate reputational fallout and protect your brand in the event of a cyber incident.
Any cyberattack can have a negative effect on a brand, especially if an organization is ill-prepared for such a hit. In this guide, we look at the three key types of cyber incidents that most frequently cause reputational damage: fraud in company’s name, data breaches, and information attacks via media and social networks.
Fraud in company’s name
A strong brand attracts adversaries who will abuse it to achieve their goals. Operating under the company’s name, they use phishing to lure customers to fake websites that feature recognizable brand identities and eventually steal their data.
For instance, threat actors posted sales ads on a large classifieds website and led buyers to phishing payment pages. Many victims thought they were being scammed by the website itself, turned down its services, and threatened legal action.
Another type of fraud is sending out phishing emails on a company’s behalf. Attackers use the organization’s branding in their emails so that unaware victims click the malicious link and lose their data. As a result, users flood the support service with complaints, write negative reviews, tell their friends about the bitter experience, or recall all their business dealings with the company.
Data breaches
A data breach is a cyber incident in which attackers steal confidential data about a company or its customers. This has an adverse impact on the reputation of organizations. Moreover, both global and local companies from different industries suffer from this.
As an example, a major credit bureau lost 13% of its share value
Account compromise and phishing have been the main causes of data leaks for several consecutive years
Information attacks via media and social networks
Another cause of reputational damage could be disinformation. Apart from scammers, such information can be spread by hacktivists
Sometimes false information is used to advance targeted attacks against organizations. One such attack was directed at a clothing manufacturer. The threat actors hacked the company’s account on a social network and announced a sale. Customers were asked to place orders in direct messages and pay through a P2P bank transfer. At the same time, the criminals launched a DDoS attack on the company’s website to prevent customers from making purchases through it. The criminals demanded a ransom from the company to restore access to the account and otherwise threatened to hack other resources used by the brand. This one targeted attack combined disinformation, fraud, DDoS, extortion, and brand hijacking.
A dishonest competitor can also be the cause of a damaged reputation by spreading fake news about a company. For example, false reports brought down the share prices of a European bank by 11%
Have you ever considered the financial toll of losing brand reputation? What areas of business are bound to suffer and to what extent? A business impact analysis helps to address these questions and choose effective risk mitigation measures. It allows companies to avoid subjective assessment and see the real picture: risk scenarios, the consequences of cyberattacks, and their criticality for the business.
It is recommended to involve different specialists when performing a business impact analysis of reputational risks: experts in business continuity management, brand protection, cybersecurity, and PR. A mutual cooperation will make it easier to assess the damage to reputation, identify potentially dangerous events, and choose response and protection measures. In this way, the organization will save its resources because it is easier and cheaper to prevent an incident than to eliminate its consequences.
In our business continuity management guidelines, we detailed the steps of the analysis. In this material, we will show you how a BIA can help protect your reputation from cyber incidents.
A company can identify potential threats to its reputation and sources of negative sentiment
An in-depth analysis of company activities will identify the factors that cause reputational damage. Thus, the brand can be harmed if the organization is unable to do the following:
- comply with the SLA
- fulfill the obligations to its customers
- build proper internal processes that eliminate possible damage to people and the environment
- ensure cyber threat protection and customer data safety
This can lead to negative feedback and complaints, unscheduled inspections after complaints, and other adverse consequences. Combined, they can slow down business processes and lower profits.
Reputational damage is most often measured in negative reactions from customers and the media, regulatory sanctions, sometimes in customer outflow, and less commonly in sales reduction and a drop in share prices. The degree of each impact is unique and depends on various factors: the company’s size, specialization, segment (B2B or B2C), etc.
With a BIA, a company can see which events may harm its reputation, and use this information to create an impact types and levels matrix (impact matrix). With it, the organization will be able to assess the damage and determine the threshold at which the situation becomes dangerous for business resilience.
There are two ways to reflect damage in the impact matrix:
- by impact criteria (approach 1)
- by event type (approach 2)
Consider both in the case of an information attack.
Approach 1: Impact matrix by impact criteria
| Impact type | Level of impact and assessment criteria | |||
|---|---|---|---|---|
| Acceptable | Significant | Critical | Unacceptable | |
| Negative reviews or publications in open sources | Minor negative reviews or publications on lesser-known resources | Spreading negative sentiments about the company on the Internet, mentions in local media, negative publicity for more than 7 days | Widespread dissemination of negative comments on the Internet, mentions in regional media |
Widespread negative publicity in the major media and news channels
Business adversities due to widespread negative publicity
|
| Complaints against the company from customers or counterparties | Occasional complaints from customers or counterparties | Multiple complaints from customers or counterparties |
Mass complaints from customers or counterparties, including written complaints to the authorities
Likely lawsuits
|
Complaints from customers or counterparties initiated in court proceedings
Penalties
Loss of business reputation
|
| Customer outflow | Customer outflow ≤1% | Customer outflow 1–5% | Customer outflow 5–10% | Customer outflow >10% |
| Difficulties in acquiring new customers |
Decrease in the influx of new customers 1–2%
Minor difficulties in closing new deals
|
Decrease in the influx of new customers 3–5%
Difficulties in closing new deals
|
Decrease in the influx of new customers >5%
Decline in further cooperation with potential clients <10%
|
Decrease in the influx of new customers >5%
Decline in further cooperation with potential clients >10%
|
| Decline in revenue | Decline in revenue <5% | Decline in revenue <10% | Decline in revenue <20% | Decline in revenue >20% |
Approach 2. Impact matrix by event type
| Event type | Level of impact and assessment criteria | |||
|---|---|---|---|---|
| Acceptable | Significant | Critical | Unacceptable | |
| Information attack |
Minor negative reviews or publications on lesser-known resources
Occasional customer complaints
No negative attitude from the majority of counterparties
|
Negative publicity in the media
Increase in the number of customer complaints
Negative attitude from counterparties
Occasional problems when interacting with future customers and counterparties
|
Widespread negative publicity in the media
Deterioration of trust among customers/counterparties
Likely rejection to close new deals
Customer outflow
Drop in share prices ≤5%
|
Widespread negative publicity in the major media and news outlets
Termination of current contracts, refusal to close new deals
Loss of business reputation
Drop in share prices >10%
|
The result does not depend on which approach a company chooses. The main thing is that the impact matrix should reflect reality and function properly in the applied assessment methodology.
A company can determine how to mitigate the impact of reputational damage
With the help of a BIA, a company will determine how reputational damage may affect business performance. After that, the company can begin to develop mitigation measures.
To this end, it is necessary to analyze the company’s business processes and understand how the negative impact will escalate. It is worth taking into account all of the company’s assets that may be affected. The data obtained is used to calculate the RTO
For instance, estimates might show the following:
| Remediation time | Impact on reputation |
|---|---|
| One to several hours | No consequences |
| Several hours to a day | Communication with customers or a statement from PR is required to mitigate reputational damage |
| More than a day | Even media refutations cannot save a company from public scandal or defamation, and you need to take steps according to an emergency action plan |
The timelines and consequences are given as an example. As part of the BIA, a company will determine the nature of the incident and the cause of the damage. Based on this data, you can plan response steps together with PR, marketing, finance, legal, and other departments.
A company can lay out the steps to protect the brand before and after an incident
Mitigating damage from digital threats requires a holistic approach: take preventive measures and respond effectively to incidents that have already occurred.
Having obtained the BIA results, a company can identify the events that are most harmful to reputation, and work proactively. This includes monitoring the media coverage, identifying phishing websites and leaks, and sending requests to block them. This work can be done internally or by using specialized solutions such as BI.ZONE Brand Protection. Such platforms can help identify and neutralize online threats to a brand. These services can be managed independently or with expert support.
If an incident has already occurred, it is critical to respond quickly. This is possible where company departments know their roles and act in cohesion. To improve communication, prepare an incident management plan in advance. We recommend using simple language and clearly defining the areas of responsibility and the course of action for each department. The plan will help the cybersecurity and IT departments to ensure technical resilience, and the PR department, to reduce the impact of negative information.
Open and honest communication with your target audience during an incident is one of the key factors in preserving the company’s reputation. To ensure that information reaches the target audience in a timely manner, you need to select the communication channels in advance and have an emergency action plan for each scenario.
We would like to stress that when a company’s reputation is at risk, it is crucial for senior management to participate in brand protection activities and quickly make responsible decisions.
In this section, we will share some ground rules that will help to preserve the brand image. We have consolidated global best practices, our own expertise, and the experience of those who have successfully navigated the aftermath following an incident.
Our guidance and checklist will help you safeguard your reputation in the event of a cyber incident. The guidance details the actions that an organization should take to protect itself and its customers
Before we get to the guidance, note that companies should have incident management policies and a crisis management team. For instance, this could include the following:
- PR specialist to document the emergency timeline
- PR executive
- cybersecurity officer
- marketing expert
- customer communications representative
- IT infrastructure specialist
- chief commercial officer
- legal adviser
- heads of services or assets that may be affected
- coordinator of the team and all public communications. In a large-scale crisis, this could be the chief operations officer or another senior executive
Each team member should be aware of their respective roles and be committed to fulfilling them efficiently, including after hours. If an employee knows that they will be unavailable, they should inform the relevant individuals and assign a substitute.
Responding to scammers faking your corporate website or sending out phishing emails on behalf of your company
- Start investigating the incident.
-
At the same time, define and align the company’s official position and consider how to communicate it to the public. This should be done within the first 2–3 hours after the incident was discovered.
Media engagement in the event of a cyber incident depends on how negative information is being circulated. The flowchart shows how companies should behave in different situations.
- Instruct the employees who deal with customers on how to handle complaints and grievances in a given situation. Emphasize to relay only the official position of the company.
-
Contact your customers through key communication channels, ask them to stay on alert for scammers that create phishing pages (mimicking your corporate website), and explain the scam in detail.
If your company is subject to regular cyberattacks, we would specifically recommend that you work on building up your customers’ cyber awareness. This will serve as yet another layer of resilience to your brand.
-
Block fraudulent domains by reporting them to the following authorities:
- domain registrar
- hosting provider
- top-level domain administration
- CERT
in the country of the registrar and hosting provider - ICANN
(if the previous authorities fail to cooperate, but you are sure that a website is phishing) - a company that blocks fraudulent sources
Going forward
Take preventive measures to reduce adverse effects on your reputation: set up monitoring to quickly detect new domains that may abuse your brand identity.
Addressing incidents of sensitive data breach
-
Initiate an investigation. Find out what data got stolen and how. Keep in mind that the scammers likely possess more information than they release to the public.
Crime investigation requires a range of expertise: network digital forensics, the workings of operating systems, security tools management, malware analysis, etc. Therefore, we recommend contacting an expert organization specialized in responding to a variety of incidents.
- At the same time, start eliminating the cause of the leak. Conduct a detailed technical review of the intruders’ actions, revise the data access model and your security tools. Take measures to quickly minimize the damage. For example, automatically reset passwords for all customer accounts.
-
Define and align the company’s official position and consider how to communicate it to the public. This should be done within the first 2–3 hours after the incident was discovered.
Media engagement in the event of a cyber incident depends on how negative information is circulated. Our flowchart shows how companies should behave in different situations.
- Instruct the employees who deal with customers on how to handle complaints and grievances in a given situation. Emphasize to relay only the official position of the company.
- Contact your customers through key communication channels within the first 2–3 hours after the incident and tell them how sensitive the compromised data is. Assure them that you are investigating the incident and taking all steps to minimize the negative impact and prevent future incidents. Advise customers on how to act in an emergency to mitigate the damage. For example, suggest resetting passwords for all personal accounts. Communicate openly and honestly.
- Assess the legal risks, taking into account the laws of your country. You may need to notify regulators or contact law enforcement.
Addressing incidents of sensitive data breached through a contractor
- Contact the contractor as soon as possible. Find out the details of the incident—at the very least, the type and amount of data stolen.
- Prepare and launch a response plan for your infrastructure. Maintain communication with the contractor. If you engage an expert organization to solve the problem, coordinate the experts and advise the contractor where necessary.
-
Define and align the company’s official position and consider how to communicate it to the public. This should be done within the first 2–3 hours after the incident was discovered.
Media engagement in the event of a cyber incident depends on how negative information is circulated. Our flowchart shows how companies should behave in different situations.
- Instruct the employees who deal with customers on how to handle complaints and grievances in a given situation. Emphasize to relay only the official position of the company.
- Contact your customers through key communication channels in the first 2–3 hours after the incident and tell them how sensitive the compromised data is. Assure them that you are investigating the incident and taking all steps to minimize the negative impact and prevent future incidents. Advise customers on how to act in an emergency to mitigate the damage. For example, suggest resetting passwords for all personal accounts. Communicate openly and honestly.
- Assess the legal risks, taking into account the laws of your country. You may need to notify regulators or contact law enforcement.
Addressing incidents of corporate accounts leaked through third-party services
This does not threaten the brand directly, but it does increase the likelihood of your organization being hacked, which can damage your reputation. In this situation:
- Reset the password on the employee’s computer as soon as possible.
- Have your cybersecurity service check if the employee has ever used the compromised password to access the account. If they have, investigate all of the employee’s authentications for anything suspicious about them. This way you can determine if the intruder used the compromised password.
-
Have a conversation with the employee. Remind them of the important rules:
- Avoid using your corporate email to register on third-party websites without a business need.
- Set unique passwords for different accounts and services.
- Use a password manager.
- Connect two-factor authentication.
- Change your password at least once every three months.
Going forward
Be proactive to minimize the reputational losses caused by data leaks on either side. Use services that aggregate data leaks from different resources to run regular checks for compromised corporate usernames and passwords. Increase employee cyber awareness and conduct attack simulations. See our guidelines for more information on building an effective training system.
Addressing incidents of negative or false publications about your company amid a suspected information attack
-
Make sure it is a targeted information attack and not a natural information burst, which could arise, for instance, from customers not being able to access your server as a result of a disruption.
Signs of an information attack:
- Mass dissemination of false or distorted information that addresses a single topic.
- Initial circulation by small and little-known resources, fake accounts, and bots.
- A large number of identical messages that match the text in a suspicious primary source.
- Periodic and extended circulation. It can last for months and consist of steps that are repeated at intervals. To the contrary, when the information spreads naturally, its circulation reaches a peak, after which the media landscape gradually cools. Natural information waves usually last no more than seven days.
- If you are certain that the company is under an information attack, proceed to monitor the negative news flow and the public’s reaction.
-
Define and align the company’s official position and consider how to communicate it to the public. This should be done within the first 2–3 hours after the incident was discovered.
Media engagement in the event of a cyber incident depends on how negative information is circulated. Our flowchart shows how companies should behave in different situations.
Going forward
Keep a constant eye on the media and social networks. This will help you spot any preparations for an information attack, respond quickly, and better understand the customer experience. You can delegate this task to a PR department, or hire a dedicated specialist, or resort to automated services. The choice depends on the available budget.
Sometimes, sings of preparations for an attack can be indirect:
- Surveys and polls being conducted regarding your company.
- Numerous groups and accounts suddenly appearing on social networks, spreading negative information about the company.
- False information appearing on a particular resource and provoking discussions.
Develop a strategy to respond to the most likely information attacks. Analyze your company’s weaknesses to understand where the attack might be targeted at. Consider external factors that could affect your organization: economic crises, pandemics, new legislations, etc. Note that information attacks can be timed with important company dates.
Flowchart. Dealing with the media in an incident
-
The responsible person assembles the entire crisis management team (if necessary) or assigns relevant specialists. The experts decide whether the situation requires a rapid response or can be handled as normal.
For example, fake news published on a resource with a bad reputation and a small audience. If the disinformation appears on one such website only, the situation is not critical and does not require additional action.
If the negative news was published by an influential media outlet (tier 1
or tier 2 ) or the well-known X channel with an audience of many thousands, the situation should be recognized as an emergency. It will require intervention by the crisis management team. -
The PR specialist begins to document the developments in the media. This should be done in parallel with incident management in order to track the escalation of the emergency, establish cooperation with the media, work on mistakes, and streamline PR activities. The specialist needs to record in detail:
- causes of the media incident
- development of the crisis
- channels and methods used by PR to communicate with the customers and media
- outcomes of public communication and its role in resolving the issue
-
The responsible team member determines the goal of communication and the success criteria.
An example of criteria to assess effectiveness:
- The media publish the official position of the company.
- In 1–2 days after the emergency starts, the company’s position is reflected in most of the incident-related publications.
- More and more positive messages from users appear in thematic chats and social media channels.
- The responsible team member assigns a person to collect the material for publication in the media, draft texts, and establish chains of approval. Note that it is important to be honest, speak directly, and avoid clerical language in corporate communications.
- The responsible team member decides on the formats
and distribution channels for emergency communication. For example, you can opt for short posts on social networks, or a press release with the company’s statement, or an official letter to priority customers. - The PR department sends the agreed material to the media: first, to key media outlets and journalists, then en masse to industry publications important to the company. At the same time, the official statement is published on the company’s website and social networks, and email newsletters are sent out to customers.
-
The PR specialist documenting a crisis in the media begins to monitor the reactions of media:
- all outlets that wrote about the emergency
- all outlets that, after receiving the press release, changed the original news or wrote a new one mentioning the company’s position
On the first day of the crisis, the media coverage should be monitored at least once every 20–30 minutes. The next day, if the crisis does not escalate, monitoring can be reduced to every 1–2 hours. The frequency of monitoring can be gradually minimized in corroboration with the crisis management team. Aim towards at least 1–2 monitoring updates a day for the first week after the incident.
- The team leader keeps the senior management informed about the crisis developments.
-
If after 1–2 days of communications in the media and social networks the crisis continues, the PR department makes a list of media and journalists that are most loyal to your company, contacts them for information support, and offers an exclusive comment or a more detailed story about the incident.
If the crisis nonetheless continues, the PR team needs to find as many positive newsworthy events about the company. For example, an award earned by the organization, new research, or new product development. The PR department can look for some draft materials on these topics scheduled for later release. In case of an emergency, it is worth moving quickly, offering the news for publication in the media and additionally supporting it with paid promotion in relevant media outlets or major X channels. If there is no positive news or it had no desired effect, you can offer a friendly journalist from a major media outlet an exclusive interview with a senior manager. It will help to promote the company’s key position.
Depending on the situation, maintaining silence for a few days may also help. However, we recommend open and honest interaction with the public.
Companies do not always quantify the impact that digital threats can have on reputation. However, cyber incidents may cause severe brand damage and significant financial losses. To mitigate the adverse impact, organizations should prepare for potential threats in advance: use a BIA to predict the vectors of a cyberattack, develop an emergency action plan, and create a trained response team. This will help to preserve your reputation in a crisis.