You don't know yet if it's true. You don't know if it's one guest or ten. You don't know if it's a rumor or the start of a health department investigation.
What you do know is that the next hour matters more than the next month.
The first question isn't "what do we say." It's "what are we dealing with."
Most restaurants default to drafting a statement. That's the wrong first move.
Before anyone writes a word of external messaging, you need to answer one question: is this a confirmed outbreak, or an unconfirmed report?
Those two situations call for almost entirely different responses. A confirmed outbreak means health regulators, insurance, and possibly a temporary closure. An unconfirmed report means investigation, discretion, and — in most cases — no public statement at all.
Treating the two the same is how restaurants either overreact to a rumor or underreact to a real problem.
If it's confirmed: closure or recall, not "wait and see"
Once an outbreak is confirmed, the decision tree branches again: does this require a temporary closure for remediation, or can you manage it through an ingredient recall while staying open?
A closure means professional biohazard cleaning, mandatory staff retraining, and a hard "no reopening until inspectors clear you" rule. A recall means pulling the suspected ingredient, auditing prep stations, and getting a replacement shipment from an audited supplier, without shutting your doors.
Neither path starts with a press release. Both start with quarantining the suspected food, looping in counsel and your insurance broker, and telling staff to stay silent externally and route every question to one designated communications lead.
Only after those steps are underway does outbound messaging happen, and even then, it goes to two very different audiences with two different messages.
To staff, keep it short and directive. Here's the actual SMS template from our foodborne illness playbook, sent the moment a closure is confirmed:
We are temporarily closing for a voluntary sanitation sweep. Do not report for your shift today unless directly contacted by your manager. Watch your email for updates and refer outside questions to communications.
No explanation, no speculation, no reassurance — just what to do and who to route questions to. Staff don't need the full picture in a text message; they need clear instructions they can act on immediately.
To guests, the tone changes. They need enough context to trust that you're handling it seriously, without you overstating what you actually know. From the same playbook, the customer-facing closure notice:
Dear Guests,
In response to a confirmed health incident, we have voluntarily closed our restaurant temporarily to perform a comprehensive professional deep cleaning and sanitation sweep.
What is confirmed is that we are cooperating fully with local health officials to isolate the source and have paused all food preparation; our exact reopening date is not yet known, and will be determined once we receive formal clearance from the health department.
We apologize for the disruption. For guests with upcoming private event bookings or catering reservations, our team will reach out directly to coordinate refunds or rescheduling. We will share reopening updates on our website.
Notice what this message doesn't do. It doesn't guess at a cause. It doesn't promise a reopening date. It doesn't admit fault. It states what's confirmed, what's still unknown, and what happens next — which is exactly the line a legally sound crisis message needs to walk.
If it's unconfirmed: don't let the response become the story
An unconfirmed report is a different kind of risk. The illness claim might not even be real. But a clumsy response to a rumor can generate more damage than the rumor itself.
The playbook splits this branch too: is the claim generating public attention, viral posts, press inquiries, or is it still a private complaint you can handle discreetly?
If it's public, you loop in PR counsel before responding to anything, commission an independent food safety audit, and issue a holding statement that acknowledges the claim without confirming or denying it. If it's private, the instruction is almost the opposite: follow up with the guest quietly, keep the investigation internal, and avoid escalating something that may never become public in the first place.
The failure mode in both cases is the same — responding before you've verified anything, in a way that outruns the facts you actually have.
The pattern underneath all four branches
Look across the four possible paths: closure, recall, public rumor, private claim - and the structure repeats:
- Convene the right people first (management, counsel, insurance, or PR - depending on severity).
- Contain the physical and operational problem before anyone talks publicly.
- Silence untrained voices: staff get a short, clear instruction to redirect questions, not a script to explain the situation themselves.
- Send audience-specific messaging: staff and guests never get the same message, because they need different information to do different things.
- Monitor and log for 24–48 hours after the fact, so you have a record and can catch a rumor before it spreads.
That's the actual value of a playbook like this: not the individual templates, but the decision structure that tells you which templates apply to your specific situation, in what order, sent to whom.
A foodborne illness scare doesn't wait for you to figure out your response
The templates above are drawn directly from CrisisComms.io's Foodborne Illness Scare playbook, a decision-tree-based template that walks your team from "we're not sure what's happening" to "here's exactly what to send, to whom, right now," branch by branch.
Restaurants don't get to schedule their crises. But you can decide, in advance, exactly what happens in the first hour of one.