How could this happen?
That’s one of many questions erupting in the aftermath of Equifax’s recently disclosed data breach, along with the following queries:
- Was my personal information compromised?
- Are they protecting themselves or the public? Is all the bad news out, or is there more to come?
- Did senior execs dump stock before public disclosure?
Equifax is a leading consumer credit reporting agency, responsible for safeguarding highly sensitive financial and other personal data for more than 800 million consumers and businesses globally.
In a corporate crisis, the first challenge is the precipitating issue (in this case, the breach itself). Here, Equifax failed. For any corporate crisis, how an organization responds can hasten reputational recovery—or accelerate damage to it. Here, too, Equifax failed.
Consider these six takeaways from Equifax’s communications stumbles:
1. Timing is everything. “What did the president know, and when did he know it? ” was Sen. Howard Baker’s famous question posed during the congressional hearings on Watergate. It’s a question that’s now routinely asked of organizations’ leadership teams when a scandal goes public.
Equifax first learned on July 29 that personal data had been exposed, but it notified the public on Sept. 8 (as national news outlets were distracted with 24/7 hurricane coverage).
Yes, it takes time to ready for public disclosure, work with law enforcement and so on. Fair or not, the perception of corporate stalling while millions of affected Americans were left in the dark for six weeks hurts public trust, and just when Equifax needs it most.
2. When you fall down, step up. When an organization fails at its responsibilities, stakeholders rightfully expect its execs to engage and communicate head on. Equifax hunkered down.
As The Atlantic observed after it requested an interview, “ Equifax offered no further comment beyond the materials they had published on an informational website. Other outlets experienced similar silence.”
3. Prepare to own—or get owned—on social media. During a crisis, much of the reputational battle will occur online, so the social media team had better be briefed, savvy and caffeinated when it goes public. It’s telling (and a bit stunning) that—with Equifax having had more than a month to prep for public disclosure—Mediaite offered the headline,“ Equifax Slaughtered on Twitter For Wishing Customers ‘Happy Friday’ After Data Breach.”
Equifax got “slaughtered” not for the breach itself, but rather for the insensitivity of a tone-deaf social media post right as the issue was blowing up. Good reminder, too, when bad things happen, immediately turn off any pre-programmed posts that could be in the queue.