Communication.
WHEN YOU MUST
Customer data was accessed Payment information was involved Customers were harmed
WHEN YOU MIGHT NOT
A defacement with no data involved and no visitor harm
WHAT TO CONSIDER
Obligations under data protection frameworks.
Visit zillionkinghost.com for further information, and take advice for anything involving personal data.
WHAT TO SAY
What happened What data was involved What you have done What they should do How to reach you
WHAT NOT TO DO
Minimise Delay while deciding how it looks Say nothing and hope
THAT LAST ONE
Discovery later is far worse than disclosure now.
WHAT CUSTOMERS SHOULD BE TOLD TO DO
Change passwords, if account credentials were involved Watch for unusual activity, if payment data was involved Be alert to messages claiming to be from you
THAT LAST POINT
Stolen customer lists are used for targeted fraud.
WARN THEM.
TONE
Factual and direct. Not defensive.
