Breach Disclosure PR Timing: The 72-Hour Comms Sequence

A breach hits your client at 2 AM. Your phone lights up. The security team has confirmed unauthorized access. Legal is already awake. Someone in the executive team is drafting a tweet.

Stop. Put the phone down. What happens in the next four hours determines whether this stays a contained incident or becomes the story.

I'm writing this from a communications operator's perspective, not a legal one. Your lawyers can tell you what to file and when. What they can't always tell you is what to say, to whom, in what order, and what will blow the story open before you're ready. That's the job.

Why this disclosure moment is different from every other crisis

Most corporate crises have some lead time. A funding round that falls through, a co-founder departure, a regulator asking uncomfortable questions. You have hours or days to prep. A breach gives you none of that.

Three regulatory clocks start the moment awareness is confirmed, and they overlap in ways that most comms teams aren't ready for.

GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. The SEC's Item 1.05 on Form 8-K requires public companies to disclose a material cybersecurity incident within four business days of the materiality determination — not from discovery, but from the moment the company determines the incident is material. Most U.S. state laws require individual consumer notification within 30 days of discovery.

The clock that trips most companies: the GDPR 72-hour window starts running from the moment your organization "becomes aware" — which under EDPB guidance means when you have a reasonable degree of certainty that a breach of personal data has occurred. Early detection means an early clock start. If your European security team flags an intrusion on Monday morning, your 72-hour supervisory authority notification window opened Monday morning, not when your CEO gets briefed Tuesday afternoon.

The SEC clock is slightly different. It starts at the materiality determination, not at discovery. But the SEC is explicit that companies cannot sit on an incident to avoid starting the clock. The materiality call must happen "without unreasonable delay" after discovery.

The comms implication: your narrative cannot wait for a clean forensic picture. You will never have one in 72 hours.

The two failure modes that turn a contained breach into a reputational crisis

I've seen both kill companies that survived the breach itself.

Failure mode 1: Saying too much too early. The pressure to reassure stakeholders is intense in the first six hours. Executives want to project control. Legal wants to prevent class action exposure. Communications teams, trained to fill information vacuums, reach for specificity that doesn't exist yet. So someone says "no sensitive data was accessed" before forensics has confirmed scope. Or "we've contained the situation" before the third-party IR team has even started. When the investigation proves those claims wrong, and it often does, you're not managing a breach story anymore. You're managing a cover-up story.

Uber discovered a 2016 breach affecting 57 million riders and drivers and stayed silent for over a year, only disclosing in November 2017. The delay led to a $148 million settlement and a criminal conviction for the company's former security chief.

Failure mode 2: Saying too little too late. Silence reads as concealment. When a trade reporter emails your press inbox asking about a "major breach" — and they will, often because someone leaked internally or it surfaced on a breach monitoring forum — no response is a story in itself. Staying silent for the first 12 hours while you figure things out is a communications void that speculation fills immediately. By the time you issue your holding statement, the narrative frame is already set, and you're reacting to someone else's version.

As I posted back in February 2023:

It's very important to control your story and actively shape it before it's lost! Shilika Jain on X, 10 Feb 2023

A breach is the moment where that maxim is tested hardest. The companies that handle it well understand that "controlling the story" does not mean suppressing it. It means owning the sequence.

The stakeholder sequence: who hears what and when

This is where most playbooks skip the hard part. Legal briefings, regulatory notifications, IR calls, customer emails, press statements — they all have dependencies. Get the order wrong and you create either a selective disclosure problem (IR violation) or a spokesperson inconsistency problem (PR crisis).

Hour 0 to 2: Internal containment, single incident commander

Before any external communication, one person owns the response. Incident commander is not a PR role at this stage. It's typically CISO or CTO with the general counsel in the room. The communications lead should be in the first briefing call to understand scope and take forensic status notes, but no external statement goes out until legal clears the factual frame.

The first PR task is to freeze all scheduled social content immediately. This sounds obvious. It's missed more than you'd think. A scheduled "Cybersecurity Awareness Month" post during a live breach is the kind of own-goal that ends careers.

Hour 2 to 6: Board and audit committee, outside counsel retained

The board chair and audit committee chair need to be briefed verbally before any formal disclosure decision is made. For public companies, the general counsel needs outside counsel engaged at this stage, both for the attorney-client privilege protection over the response and for command of the disclosure requirements across jurisdictions. Outside counsel has a better grip on the intersection of state notification laws, GDPR, SEC Item 1.05, and any sector-specific regimes (HIPAA, NYDFS Part 500, PCI DSS) than in-house counsel typically does.

The communications team drafts the holding statement during this window. Not after. During. You want it ready before a reporter emails.

Hour 6 to 12: The holding statement goes external

The holding statement is not a press release. It does not explain the breach. It does not speculate on cause, scope, or attribution. It does six things:

1. Acknowledges the incident plainly, without euphemism
2. Confirms that investigation is active and ongoing
3. States what protective steps are immediately underway
4. Tells affected people what action, if any, they should take right now
5. Names a single point of contact for media inquiries
6. Commits to a specific time for the next update

What the holding statement does not do: it does not say "no evidence of widespread impact." It does not say the breach was contained. It does not attribute the incident to a nation-state or specific threat actor. Those claims require forensic certainty you don't have.

For a public company, this holding statement goes out simultaneously with (or just after) the SEC Form 8-K filing if the materiality determination has already been made. Do not issue a press release before the 8-K is filed. The SEC has been explicit that Item 1.05 disclosure should precede or coincide with public comms, not follow them.

Hour 12 to 48: Regulators, customers, cyber insurer

Regulatory notifications should be under legal coordination, not communications coordination. But the communications team has a role: the language used in regulatory notifications often becomes the language of subsequent press releases. Align the narrative across documents now rather than after a reporter identifies inconsistencies between your 8-K language and your customer notification email.

Customer notification timing is governed by state law (30 days in most U.S. states) and GDPR's phased notification model. On the GDPR point: the rules allow phased notification. You submit what you know within 72 hours, flag what you don't, and update the supervisory authority as investigation matures. This is not weakness. It's the model the regulation was written to accommodate.

Notify the cyber insurer within their contractual window — typically 24 to 72 hours from incident awareness. Failure to notify promptly can result in coverage denial. This matters for communications because your insurer may provide crisis PR resources as part of the policy. Know this before the breach.

Hour 48 to 72: Secondary stakeholder communications

This is the window for broader stakeholder comms: employee communications (with explicit guidance that staff do not speculate publicly), enterprise customer briefings via account teams, and partner notifications under contractual disclosure terms. Each of these audiences needs a version of the same core narrative, calibrated to what they need to know and what they need to do.

A single communications operator should own the narrative document that all of these channel-specific messages are drawn from. Inconsistency between what the IR team tells analysts and what the customer success team tells enterprise clients creates the "conflicting reports" headline you're trying to avoid.

Hour 72 to 96: Press briefings and full public statement

For public companies, this window is the close of the SEC four-business-day window from materiality determination. By this point you should have:

• A filed 8-K with full disclosure of what is known
• A press release distributed through BusinessWire or PR Newswire with the same core facts
• A named spokesperson, either the CEO or the CISO depending on breach type, available for trade press
• Pre-scheduled briefings with key security trade reporters within the filing-plus-two to filing-plus-eight hour window

The media target list for cybersecurity incidents is more specific than a standard tech announcement. Security trade press (Dark Reading, SC Media, SecurityWeek, Bleeping Computer for technical audiences), business press (Wall Street Journal, Financial Times), and sector-specific press based on the breach type. A healthcare data breach calls for reporters covering health tech and HIPAA compliance. A financial institution breach leads with WSJ and CNBC.

The spokesperson question

Do not send legal to do the talking. Statements that read as liability shields, vague in language and empty of empathy, are standard practice and standard failure. The general counsel's job is to approve what the spokesperson says, not to be the spokesperson.

For a cybersecurity company, the spokesperson is almost always the CISO. Their technical credibility is the only thing that can hold ground with a skeptical security trade reporter who has already read your 8-K filing and spotted three ambiguities. The CEO speaks to the human impact and the business response. The CISO speaks to the technical facts.

For a non-security company that suffered a breach, the CEO is typically primary. Their message is simpler: what happened to customers, what the company is doing about it, and what it's putting in place to prevent recurrence.

One spokesperson. One approved messaging document. Every employee who might receive media contact — customer support, sales, operations — gets a single line: "We are not in a position to comment beyond our official statement. I can direct you to our media contact."

What the 30-day window means for sustained comms

State notification to affected consumers typically runs on a 30-day window from discovery. That is not a 30-day blackout on further press engagement. After the initial disclosure cycle settles, around day five to ten, the story enters its second phase: remediation, accountability, and the "what are you doing differently" question.

This is where a cybersecurity company's communications record becomes either an asset or a liability. A company that disclosed promptly, communicated clearly, and followed through with specific remediation steps has a reputational recovery path. A company that delayed, minimized, or put legal language where empathy belonged spends the next quarter in reactive mode.

As I noted when thinking about the crypto market crisis year of 2022 — which had more breach and rug events than most industries see in a decade:

Transparency is the key to successful web3 business. Medias have emerged as the strongest source of truth this season. Shilika Jain on X, 18 Nov 2022

That applies directly here. In a breach, media are the strongest source of narrative correction, and they will fill the void with whatever information they have. Give them verified facts or they work with what they can find.

A note for private companies and startups

Most of this post addresses public companies because the SEC 4-day rule only applies to them. If you're pre-IPO or private:

• Your SEC obligation is zero. Your reputational obligation is identical.
• GDPR still applies if you handle EU personal data, regardless of your incorporation status.
• State breach notification laws apply regardless of listing status.
• Your investors, enterprise customers, and enterprise prospects are all public company IR teams watching how you handle this.

The standard you hold yourself to in breach disclosure is a direct signal to your eventual Series B or Series C investors about how you run governance. Companies that handle breaches transparently, fast, and on a documented sequence attract better capital than companies that bury incidents until they surface in due diligence.

What pre-built infrastructure looks like

The companies that handle breaches well are not smarter or luckier. They have pre-built infrastructure:

• A holding statement drafted for 3 to 4 likely breach scenarios before any incident occurs
• A named incident commander with a defined decision chain
• Outside counsel already engaged and briefed on the company's jurisdictional profile
• A cyber insurer with the policy notification requirements documented
• A spokesperson with existing media relationships in the security trade press

That last item matters more than people realize. A CISO with a byline history in Dark Reading or SecurityWeek, who has spoken at Black Hat or RSA, is a credible source when a trade reporter is on deadline. A CISO with zero public presence is a stranger making claims that can't be verified.

Building that spokesperson profile is a PR function, not a security function. And it's work that has to happen before the breach.

---

If you're building out a cybersecurity communications program, or you need a PR operator who understands how the regulatory and media tracks intersect during an incident, book a 30-min teardown with Shilika.