It Pays to be Prepared in a Crisis

Every business, no matter how well run, is vulnerable to a crisis. Some arrive with little to no warning: a major data breach exposing sensitive customer data, a fatal accident in the workplace, a social media post gone viral, or an allegation against a senior executive.

In those critical early hours, what you say, how fast you say it, and how empathetic you sound can make the difference between protecting your reputation and compounding the damage. A swift, measured response can reassure customers, retain stakeholder confidence and limit disruption. Poor communication can allow speculation to run wild, erode trust and magnify the fallout.

At WPR, we have seen that the organisations best able to emerge from crises are those that treat readiness as a strategic priority, not an afterthought. Below are three principles, illustrated with recent real-world examples, to help you shape a robust crisis communications strategy.

1. What is a Crisis?

Many leaders reserve the label “crisis” for catastrophes. In fact, a crisis can be any event with the potential to harm your reputation, disrupt your operations or undermine the trust of customers, employees, regulators or investors. A single customer complaint that goes viral on social media can escalate into a full-blown reputational storm if not handled early.

It helps to think of crises in tiers. A ‘Level 1’ incident might be a localised issue or negative media mention that has the risk of escalation. A ‘Level 2’ crisis involves matters that attract broader public attention. For example, a controversial campaign, adverse press coverage or complaint from a high-profile customer or employee. At the top, ‘Level 3’ crises are those with serious operational, legal or safety implications – think cyberattacks, health and safety incidents or allegations at a senior level.

In April 2025, Marks & Spencer’s systems were hit by a cyber incident that disrupted online ordering and click-and-collect services. It was later traced to a third-party provider and suspected to involve a ransomware group. The breach impacted the business’s reputation, customer operations and its stock market value. Because it was scaled and highly visible, it commanded a Level 3 response.

In another instance, in September 2025, Harrods warned that personal customer data may have been compromised due to a breach at a third-party provider. While the data involved was limited to identifiers (not passwords or payment data), the reputational risk was high, especially in the luxury retail sector. That kind of incident, though “lower severity” in a technical sense, still requires serious care in messaging, because trust is core to the brand.

Recognising the level early helps you scale your response, marshal the right teams, decide who speaks, allocate budget and determine how transparent you can afford to be without doing more harm.

2. Get Ahead of the Headlines

The difference between a reactive scramble and a composed response lies in what’s built beforehand. A crisis communications plan is not a ‘box-ticking’ exercise, it is your organisation’s playbook under pressure.

Such a plan should anticipate the risks most relevant to your industry, map out decision-making responsibilities, and define who has the authority to sign off external statements under pressure. It should include crisis templates (holding statements, media Q&A, internal updates, stakeholder letters) so that your first words can be issued quickly, even before all facts are in.

Training and rehearsals are vital. Table-top exercises and simulations help uncover blind spots that only become obvious under stress. They build muscle memory in your team so that, when pressure arrives, people act in concert rather than stray into confusion.

Consider this: the UK’s Cyber Security Breaches Survey 2025 estimates that there have been 72,000 cyber-facilitated fraud events in the past year across UK businesses. Some sectors report attacks about once per minute. The odds are not theoretical. Planning ahead is not optional.

3. Respond with Clarity, Consistency and Empathy

Once a crisis is underway, how you communicate determines whether you can stop the contagion of panic, rumour and reputational damage.

Your first step should be a prompt holding statement. This isn’t the place for detail, it should state the facts as you know them, outline the immediate steps your organisation is taking, express concern or regret, and signal your commitment to keep people updated.

Beyond that, regular updates are essential. Whether through media briefings, social media, stakeholder calls or internal communications, all channels must tell a coherent story. Employees should hear the same narrative as external audiences; otherwise, misalignment breeds distrust.

Tone matters. A crisis always involves people, those impacted, those worried, those inside the organisation working under pressure. Your message should reflect that human dimension. Acknowledge harm, express empathy and avoid language that sounds defensive or dismissive. Where details cannot be shared (for legal or operational reasons), be candid about what you don’t yet know and when you expect next updates.

Take, for instance, the 23andMe data breach. Sensitive genetic and health data of hundreds of thousands of UK users was exposed, and the company faced regulatory fines and intense public scrutiny. The way 23andMe communicated, mandating password resets, notifying affected users, and cooperating with regulators, was as critical as the technical response itself.

A Test of Leadership

A crisis is a test of leadership, culture and organisational resilience. During high-stakes periods, leaders must show they can make decisions under uncertainty, maintain morale, and guide the organisation through ambiguity. Your communications become a reflection of that leadership.

By knowing what a crisis looks like, preparing well in advance, and responding with speed, consistency and empathy, organisations can navigate even the most brutal challenges and earn respect rather than scorn.

If your team wants to assess its crisis readiness or bring in expert communications support at the point of need, WPR is here to help.

The author: Joseph Price-Moore is PR director at WPR.  He’s a communications professional, with a global outlook and a passion for navigating complex narratives across sectors, audiences, and borders, who brings clarity, creativity, and confidence to the table.