# Data breach brand reputation: what stays findable Data breach brand reputation depends on your notice, the listings you do not control and what search and AI say. See how to keep one true story. --- A data breach damages brand reputation less through the intrusion than through the trail it leaves under your name: the notice you send, the listings others publish, the customer posts, and the answer an AI assistant assembles from all of them. Customers forgive an incident more readily than they forgive an unclear, late or evasive account of it, and that account is what stays findable for years. A breach is unusual among corporate problems because other people publish part of your record. A regulator may list your notice. A breach-notification service may add your company to a public database. Journalists, forums and criminals who claim the data will each write a version. You control one page, the notice and the support route behind it, and you decide whether the other versions have something accurate to quote. This guide is for founders, operators and in-house teams at companies that hold customer data. It does not help hide a breach: a plan that tries will fail and become the second story. It is information, not legal advice, and your counsel decides what you must report and when. Each rule quoted was read from the source page named, as it stood for this guide.
The short version
30 daysthe general time an Australian organisation has to assess whether a breach is likely to cause serious harm
More than 500California residents notified, the point above which the breach list page says a sample notice must be given to the state attorney general
One yearthe minimum period of free credit monitoring the FTC says to consider offering when financial data or Social Security numbers are exposed

Sources: the Office of the Australian Information Commissioner (OAIC) page on notifiable data breaches, the California Attorney General's breach list page, and the US Federal Trade Commission (FTC) guide Data Breach Response: A Guide for Business, all read for this guide.

## How a data breach changes brand reputation A breach changes reputation by changing what people believe about your competence and your candor, and the second belief lasts longer than the first. Competence is judged on the cause: an unpatched system, a leaked credential, a vendor's mistake. Candor is judged on the response: how soon people were told, whether the account was plain, and whether it later had to be corrected. Three groups read the trail, and they want different things. - **Affected customers** want to know whether they are at risk and what to do today. - **Other customers and prospects** want to know whether the company tells the truth. - **Partners, insurers, lenders and journalists** want scale, cause and whether management is in control. They search your name. General crisis practice applies to a breach: publish one dated record page, let disclosure duties set the order of what is said, and keep the first statement to an acknowledgement, what you are doing and when you will update. This guide concentrates on the breach-specific trail and the customer notice. ## Where a breach leaves a trail under your brand name A breach leaves six kinds of trace, and only one of them is yours. Knowing which is which decides where effort goes.
SurfaceWho controls itWhat readers learnYour move
Your notice and support pageYouWhat happened, to whom, what to doPublish early, date it, update in place
Regulator and state listingsA public bodyThat a notice was filed, when, sometimes the notice itselfMake sure the filed text matches your page
Breach-notification servicesAn independent operatorThat the company appears in a breach, and which data typesCheck accuracy, supply corrections, do not demand removal
News and forum threadsPublishers and communitiesA narrative, often based on the first factsCorrect errors with the publisher; update your page so the facts are quotable
Customer posts and reviewsCustomers and platformsThe felt experience: wait times, silence, refundsAnswer in public with the same facts as the notice
Search suggestions and AI answersSearch engines and AI assistantsA summary built from all of the aboveFix the sources; the summary follows
You can edit only the first row directly. The others respond to it: a clear, dated, consistent page gives listings, journalists and AI assistants something accurate to quote, and a vague one leaves them to fill the gaps. ## Four breach situations and the first move for each Classify before you publish anything. Companies lose days by treating an unverified claim as a confirmed theft, or the reverse.
SituationWhat you knowFirst moveMain risk
Confirmed access to customer dataLogs or forensics show data was takenContain, preserve evidence, notify under the clocks that apply, publish the noticeUnderstating scope, then having to correct it
Criminal claim, not yet verifiedA third party says it holds your data and offers a sampleVerify through your forensic team before naming a scope; prepare the notice in draftConfirming a claim that turns out to be false, or denying one that turns out to be true
Vendor or processor breachA supplier that holds your customers' data was breachedEstablish what of yours was held, then notify as the law requires; say who is responsible for whatBlaming the supplier in a way that reads as dodging
Exposure with no evidence of accessA database or storage bucket was open, logs show no misuseClose it, keep the logs, assess harm honestly with counsel, decide on notice by the rules that applySaying nothing was taken before the logs can support it
The FTC guide gives the order that holds across all four: move quickly to secure systems and fix the vulnerabilities, avoid destroying forensic evidence, assemble a team that includes forensics, legal, IT and communications, and verify that service providers who say they have remedied vulnerabilities really fixed things. It also says not to turn any machines off until the forensic experts arrive. Communications belongs in that team from the first hour, because the wording of the first notice becomes the fact base for everything after it. ## What the notice to customers must contain The regimes we read each ask for a plain description of the breach, and most name practical next steps, with differences in who is told and when. This is the legal floor, and your counsel confirms which rules bind you. The [FTC guide](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) says the notice should clearly describe what you know about the compromise: how it happened, what information was taken, how it has been misused if known, and what you have done to remedy the situation. It should also describe how you will contact consumers in the future. On the legal side, the guide tells businesses to check state and federal laws or regulations for any specific requirements that apply to them. In the European Union, [Article 34 of the GDPR](https://gdpr-info.eu/art-34-gdpr/) requires the controller to tell affected individuals without undue delay when a breach is likely to pose a high risk to their rights and freedoms, in clear and plain language. It allows an exception where the data was protected, for example by encryption, so it was unintelligible to unauthorised persons; where follow-up steps mean the high risk is no longer likely; or where individual notice would take disproportionate effort, in which case an equally effective public communication is required. The UK Information Commissioner's Office guide to personal data breaches adds that you must keep a record of any personal data breaches, whether or not you are required to notify. In Australia, the [OAIC](https://www.oaic.gov.au/privacy/data-breaches/what-is-a-notifiable-data-breach/) says covered organisations must tell individuals when a breach is likely to cause serious harm. Its page lists what a notice should include: the organisation's name and contact details, the kinds of personal information involved, a description of the breach and recommendations for the steps people can take. Where the organisation cannot reach everyone, it must put the notification on its website and promote it, for example through social media, news articles or advertisements. A legal minimum is not a reputation plan. A notice can satisfy a statute and still read as evasive. The reputational test is whether an ordinary customer, reading it once, knows what happened to them and what to do tonight. ## How to write a notice people can act on A good notice answers the customer's four questions in the order they ask them: was it me, what was taken, what do I do, who do I contact. Write it for a person reading on a phone, worried, with no technical background.
Building the customer notice
  1. Open with the plain factSay in the first two sentences what happened and whether this reader's data is involved. Do not open with an apology paragraph or a statement about how seriously you take security.
  2. List the data typesName exactly what was involved: for example, name, email address, delivery address and an encoded password. Name what was not involved only if you have confirmed it.
  3. Give the steps by data typeTell people what to do given what was exposed. Passwords call for a change, and a reused password calls for a change everywhere it is used. Where Social Security numbers were exposed, the FTC guide says people should ask for fraud alerts or credit freezes, and it points to IdentityTheft.gov/databreach for follow-up steps.
  4. Offer support that matches the riskThe FTC guide says to consider offering at least a year of free credit monitoring or other support, especially where financial information or Social Security numbers were exposed. Offering it where the data does not justify it adds noise, so match the offer to the exposure.
  5. Say how you will and will not contact peopleState the channels you will use and the things you will never ask for, such as a password or card number by email. This is the sentence that protects customers from the phishing that follows.
  6. Give a real contact route and an update dateA named team, a working form or phone line, and the date of your next update. A contact route that is unstaffed is worse than none.
Keep the notice and the page identical. If the email says "an unauthorised party accessed an order database" and the page says "a limited incident", the difference will be quoted. Write the facts once and reuse them word for word everywhere. ## Publish one page, and keep it current Publish the notice at a stable address on a domain you own, date it, and update it in place with a visible change log. A page that changes silently looks like concealment, and a page that moves loses whatever links and trust it gathered. - **Name it with the words people use.** Title it with your brand and the plain word for the event, such as "Security incident notice". A clever or euphemistic title is harder to find and reads as an attempt to avoid the word. - **Do not hide it from search.** Customers who want to check a rumor will search your name. A page they cannot find sends them to whoever else has written about it. - **Add the questions people actually ask.** The FTC guide advises posting clear, plain-language answers where people can easily find them, with the support route linked. - **If personal data was posted on your own site in error,** the FTC says to remove it immediately and notes that you can contact the search engines to ensure they do not archive personal information posted in error. It also advises searching for your company's exposed data to make sure no other websites have saved a copy. Finding stolen data in the wild is a task for your forensic team and counsel, not something to improvise. ## Listings you do not control, and the phishing that follows Third parties will list your breach, and the useful work is making sure the listing matches your page. Two examples, read for this guide, show how these listings behave. The [California Attorney General's breach list](https://oag.ca.gov/privacy/databreach/list) shows three things for each entry: the organization name, the date or dates of the breach, and the date the notice was reported. Its own explanation is that the organization that sent the notice is not necessarily the one that experienced the breach. A bank, for example, might notify customers of a merchant's breach. That matters for brand reputation, because a reader who sees only a name in a table may attribute a vendor's incident to the wrong party, or yours to the vendor. The table can be searched and downloaded, and each entry links to the sample notification. The sample notice is therefore a public document under your brand name. It should say what your page says. Have I Been Pwned, a public service where people check whether their email address appears in a breach, describes its own approach in its [FAQ](https://haveibeenpwned.com/FAQs). It does not publish formal criteria, but it describes due-diligence checks, such as whether the impacted service has acknowledged the breach and whether the data appears elsewhere online. Unverified breaches can stay in the system. The FAQ describes a process for retiring breaches in very rare circumstances, usually where the data is not being traded or redistributed, and it does not describe an organizational removal request. The practical reading is that an acknowledged breach will probably appear, and your acknowledgement is part of what it relies on. Your notice is therefore also the best input you can give any such service. ### The phishing wave After a breach, criminals use the news as cover: messages that appear to come from you, offering a refund or asking people to confirm a password, and lookalike "incident portals". You cannot stop this, but you can reduce it. Tell customers which channels you use, keep one genuine page that every message points to, check for lookalike pages carrying your name, and report impersonation to the host or registrar. A customer who knows your rules can spot a message that breaks them. ## What search suggestions and AI assistants will say Search engines and AI assistants summarize the trail, so they tend to repeat whichever version is most consistent across the sources they can read. They do not independently verify your scope. If your page, the filed notice and the news agree, the summary will agree with them. If they conflict, the summary may blend them, and a day-one figure can survive long after you corrected it. Three habits help. - **Test the questions customers ask.** Ask several AI assistants, in fresh sessions, questions such as whether the company had a breach, what data was involved and what customers should do. Record the answers with the date. - **Trace each wrong claim to its source.** An assistant that says a million records were exposed when the notice says a smaller number is usually repeating a page. Correct the page, or ask the publisher to correct it, and the answers tend to follow over time. - **Watch search suggestions.** Autocomplete may add words such as "breach" or "hack" after your brand name. They reflect what people search, and they fade as interest fades. They are not an item you can ask to be removed when they describe something true. Our [AI search reputation service](/ai-search-reputation) covers this audit when a company wants it done for it. The principle for doing it yourself is the same: fix the source, then re-ask. ## A worked scenario: an online retailer's customer database This is an invented scenario with generic parties, not a client case. Assumptions: an online retailer with 120,000 customer accounts. A forensic review confirms that an attacker copied an account table containing names, email addresses, delivery addresses and passwords stored in hashed form. No payment card data was involved because a payment processor holds it. The retailer operates in one country with a breach notification law and has customers in another. Counsel has confirmed the notification duties.
Timeline from discovery to day ninety
  1. Hours 0 to 24Contain the access, preserve logs, bring in forensics and counsel, and draft the notice and the page. Issue a short holding line only if asked: an investigation is under way and an update will follow by a stated time.
  2. Days 2 to 3Confirm scope with forensics. Send the notice by email to the 120,000 accounts in batches, and publish the page at the same hour so the email and the page match. Force a password reset on all accounts.
  3. Day 7Check the first page of results for the brand name, the filed regulator notice if any, and the answers of three AI assistants. Correct any wrong figure at its source.
  4. Day 14Review phishing reports and lookalike domains, report them, and add repeated support questions to the page.
  5. Day 30Publish the closing summary: what was found, what was fixed, what the company changed. This is the most quoted paragraph later, so keep it factual.
  6. Day 60Re-test search and AI answers. If the day-one figure persists somewhere, contact the publisher with the notice as evidence.
  7. Day 90Reduce monitoring from daily to weekly, keep the page live and dated, and file the incident record with the lessons that were applied.
The retailer sends the email and publishes the page together, so the first account a customer reads matches the one a searcher reads. It resets every password, not only the ones it can prove were copied, because a clear action is easier to explain than a fine distinction. Those are judgment calls for a generic case. ## What makes a breach worse, and how to tell trust is returning Most lasting damage comes from the response, not the event. These patterns reliably turn an incident into a longer story. - **Minimizing language.** Phrases such as "limited" or "out of an abundance of caution" read as spin when the facts are significant. - **Silent corrections.** Raising the scope without saying so looks like concealment. Say what changed and when. - **Late notice.** A customer who learns from a journalist or a criminal's post rather than from you will not credit later candor. - **Blaming the vendor first.** It may be accurate and still read as avoidance. - **Fake or planted content.** Fake reviews, fake profiles or paid manipulation to drown out the story will fail, risk platform penalties and become the second story. The same goes for pressure on journalists or posters. - **Closing the page too early.** A removed notice leaves the other versions as the only record. Trust returns when the plain account is easy to find, support questions fall and the day-one version stops appearing. Measure it with a fixed query set on a schedule: your brand name, the name with "breach", the name with "safe" or "legit", and the questions customers asked. Record whether your notice page appears for plain queries, whether a wrong figure still circulates, and whether new lookalike pages appear. Add business signals such as support volume, without treating any one number as proof. A breach rarely disappears from the record, and it should not. The aim is that a reader who finds it also finds a dated, factual account and a company that acted. [Monitoring](/reputation-monitoring) of search results and AI answers keeps that comparison running after the first weeks, when attention moves elsewhere. ## Your next step: fix the facts before you fix the page
If this is happening to you now

Write down, in one document, what is confirmed, what is claimed, what is unknown and when each will be resolved. Every notice, page and statement should draw from that sheet and nothing else. Reputation Partners can review the search and AI side of your trail in a private audit, alongside your counsel and your forensic team. Start with the private audit.

Name one owner for that document, keep a change log, and update it before anything is published. Forensics and counsel decide the facts and the legal duties. Communications decides how plainly they are said and how easily they are found. ## Questions people ask ### Can a company recover its reputation after a data breach? Yes, in most cases, but not by removing the record. Recovery comes from a clear notice, practical help for affected customers, consistent facts across every source, and visible changes afterward. The breach stays in the record. What improves is the proportion of results and answers that describe a company that told the truth and fixed the problem. ### Should a company publish a breach notice if the law does not require one? That is a decision for counsel and leadership, and the answer depends on the data and the harm. Reputationally, customers who learn about an exposure from someone else tend to judge the silence harshly. Where there is a realistic risk to people, a plain voluntary notice is usually easier to defend than a decision to stay quiet. ### How long does a breach stay in search results and AI answers? There is no fixed period. The notice, coverage and listings usually remain findable indefinitely, while their prominence tends to fall as newer material appears. Wrong details can persist in AI answers as long as the pages they came from persist. Correcting the sources and re-testing on a schedule is what changes the answers. ### Can I ask a breach-notification service to remove my company? The service we read describes retirement of a breach only in very rare circumstances, usually where the data is not being traded, and does not describe a request process for organizations. An acknowledged breach will probably stay listed. What you can do is supply accurate information and make sure your own notice states the facts clearly. ### What if a criminal claims to hold our data and we cannot confirm it? Treat it as unverified until forensics says otherwise, and prepare a notice in draft. Do not confirm or deny a scope you cannot support. If it is confirmed, you will need to move on the legal clocks that apply. If it is false, say so plainly and briefly with the evidence you have, once.