When a cyber incident strikes, attention tends to focus on systems and recovery. Yet communication largely determines how a crisis unfolds. In the CCRC podcast, Kelvin Rorive spoke with Koen van Tankeren, who has been advising organisations on spokesmanship and crisis communication for more than twenty years. They discussed what to say when you still know next to nothing, and why employees should always be informed first. And what lessons can be drawn from the hack at an external laboratory that affected Bevolkingsonderzoek Nederland, the Dutch national screening organisation?
Show that you're on it
Anyone hit by a hack wants context, guidance on what to do and an idea of what is still to come. The difficulty is that in the first hours, you usually don't know that yourself. "It's inherent to a crisis that at the start, you don't really know exactly what's going on," says Koen. Still, staying silent is not an option. People understand very well that your first priority is getting the situation under control. "If you let the outside world know that you're working on it, that you're switched on, that's much better."
You do choose the moment to share more information deliberately. But holding a press conference when you have no news to report backfires, according to Koen: "Journalists will then assume you have something to say. If you don't, you're creating your own resistance and irritation."
A cyber incident is not an IT problem
Koen: "I still too often see organisations where the IT department takes on too big a role. While a problem like this, cyber or not, affects the entire operation." The essential question is what the IT incident means for customers, employees and the business as a whole. That's why a crisis communication expert should have a permanent seat at the table in the crisis team.
When it comes to internal communication, employees should never hear from the media what's going on. So you always inform internally first, even if there's only a minute between internal and external communication. And you tell everyone the same thing. "There is only one story, not two or three."
If a journalist is waiting at the staff exit, briefing employees in advance helps very little, because emotion makes people react stiffly. "The don't-be-stupid rule simply applies here: don't do anything differently from what you would normally do. A simple guideline works better: you're allowed to just say 'no' to a journalist if you don't want to comment, and you can refer them to the communications team."
Case: Bevolkingsonderzoek Nederland
Koen was involved as an advisor to Bevolkingsonderzoek Nederland when one of the three laboratories carrying out cervical cancer screening on its behalf was hacked. The data of potentially 942,000 women who had been screened by this lab may have been affected.
This case shows how communication works across a supply chain, something Koen also discusses in the podcast. It makes clear that organisations that outsource services remain responsible for communicating with their own customers. And that clear agreements are essential to share the right information with those customers and prevent unrest.
Want to hear the full conversation? Listen to the episode with Koen van Tankeren in the CCRC podcast (in Dutch) via this link.