A verified or suspected data breach demands clear, controlled communication right away. The wrong message, or silence, can escalate legal exposure, damage trust, and create confusion for staff and customers. These templates give you practical language you can adapt immediately for common data breach scenarios.
Use them as starting points. Always have legal counsel review notifications before they go out, especially when personal data may be involved.
When to Use a Media Holding Statement
If claims about a breach appear online or media inquiries start before your investigation is complete, issue a short holding statement. It confirms awareness without oversharing details that could change.
Media Holding Statement
Subject: [Company Name] Statement on Data Security Inquiries
Body:
Statement from [Company Name]
[Date] | [Location]
We are aware of claims regarding a potential security incident and have launched an investigation with outside cybersecurity specialists to verify them.
Our operational platforms and client services remain functional. We are reviewing whether any system files were accessed and are cooperating with our cyber insurance carrier and law enforcement.
We will share verified updates on our website as the review progresses.
Media contact: [PR Contact Name] at [Phone/Email]
This keeps the conversation factual and directs further questions to one spokesperson.
Customer Notification When Systems Are Down
If the breach causes a visible outage or ransomware-style disruption, customers need a clear operational update. Avoid speculation about root cause or recovery timelines until you have confirmed facts.
Customer Outage Notification Email
Subject: Important Operational Update: [Company Name] System Outage
Body:
Dear [Customer Name],
We are writing to let you know that we are currently experiencing a technical system outage that has temporarily disrupted some of our digital portals and operations. Our security team has isolated the affected systems and is working with outside specialists to restore full functionality. We do not yet have a confirmed timeline for full restoration.
If you have urgent questions about pending orders or service requests, please reach out to our team at [Phone Number] or [Email]. We will post updates on our website.
Sincerely, [Company Name] Support Team
Pair this with a dedicated support channel so questions do not overwhelm your general inbox.
Staff SMS Alert for Operational Disruption
When systems go offline and employees need immediate direction, a short SMS reaches them faster than email.
Staff Outage and Safety Alert (SMS)
Our corporate networks are experiencing a system outage. Some databases are offline. Report to your manager for manual assignments. Refer external questions to communications.
Keep the message brief, factual, and free of technical speculation. Follow it with manager briefings so frontline teams stay aligned.
Confidential Staff Notice When the Breach Is Not Yet Public
If the incident is still internal (silent record exfiltration or an unconfirmed anomaly), staff need clear instructions without creating unnecessary alarm.
Confidential Staff Alert Email
Subject: [Company Name] Confidential: Data Security Protocol Reminder
Body:
Dear Team,
We are currently conducting an internal IT security and system audit. To protect the integrity of this work, we are reminding all staff of our standard confidentiality agreements. Our operational platforms remain functional and this does not change your daily duties. All internal IT procedures during this period are strictly confidential.
Required Actions:
- Do not discuss internal systems or audits with external partners or clients.
- Direct any external or media questions immediately to [PR Contact Name] at [Phone/Email].
Thank you for your cooperation.
- Ensure your system passwords meet our updated length requirements.
Best regards, [CEO/Management Name]
This version maintains operational continuity while reinforcing confidentiality.
These samples cover the most common communication pressure points in a data breach: media inquiries, customer impact from outages, rapid staff direction, and internal containment. Full response plans also include decision trees for verified versus unconfirmed incidents, insurance notification steps, forensic coordination, and regulatory timing.
CrisisComms.io turns these pieces into a complete, ready-to-activate playbook so your team can move quickly without starting from a blank page. You can load the full data breach response plan, customize every message, and keep roles and contacts in one place.