A cloud-hosted retailer has confirmed a breach of customer data. The marketing team wants to publish a reassuring public statement immediately, before the facts are verified. What is the best approach to customer communication?

Customer communication during a breach must balance timeliness with accuracy, and it should follow a predefined incident communication plan. That plan names who drafts and approves, typically legal and leadership, and which channels are used. Notices should state what is known, what data may be affected, what the company is doing, and what customers should do, and should be updated as the investigation confirms new facts. This approach meets legal notification obligations and protects trust. Publishing an unverified reassuring statement risks misleading customers and regulators; if later facts contradict it, the organization faces reputational harm and potential legal exposure for inaccurate statements. Delaying all communication until the forensic investigation is complete may breach notification requirements and leaves customers unable to protect themselves, for example by changing passwords or monitoring accounts; communication can be staged as facts emerge. Allowing each support agent to explain the incident in their own words produces inconsistent, possibly inaccurate or privileged information and undermines a single source of truth. Exam caveat: regulators may set their own notification timelines, so legal review should coordinate customer and regulator notices. Operational check: confirm the communication plan names approvers and channels, that holding statements are pre-drafted, and that the support team has an approved script for inquiries.