New research shows Australian consumers will forgive a data breach, but a poor response costs brands long-term

The cyber incident playbook most Australian organisations are working from needs to be rewritten for the AI era. 

Honed through more than a decade of corporate breaches, the proven steps in most breach plans remain the same: move fast, be factual, and look after customers. But going quiet once the issue is resolved and letting the story fade is no longer an option. Data from Sefiani’s proprietary AI visibility tool, Surfacd, uncovered that AI assistants are keeping breach incidents alive and surfacing them at the precise moment a consumer is making a decision about whether to buy from a brand. 

AI surfaces data breaches at the moment of decision

Sefiani looked at three organisations (two B2B and one B2C) that had been impacted by historical data breaches. When a buyer is broadly reviewing a category, breach history is close to invisible, appearing in 2.7% of AI answers. When the same buyer is asking AI search whether a specific brand can be trusted to buy from, breach history will appear in 42.2% of answers, rising to 59.1% for one organisation. Every incident looked at had been ‘resolved’ years earlier. 

Sefiani’s research also identified the information sources that AI draws on when building its response to a customer query. On average, the most influential source was corporate content – a company’s website and owned content – which was referenced in almost 90% of responses, followed by editorial media coverage, which appeared in approximately 60% of answers.

That means the channel AI checks first is the one that organisations own and can control. It is also the channel that is most likely to go quiet once the incident is resolved.

Sefiani’s Managing Partner, Mandy Galmes, said, “Consumer and B2B buyers are now increasingly trusting recommendations from AI answers as much as, or more than, advice from a brand representative. This changes what a cyber incident response needs to address.”

“Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third party commentary appeared.”

Cyber crisis expert, Shane Bell, co-founder and CEO of NSB Cyber, said, “Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre. Organisations that struggle are the ones least prepared to talk to the regulators, suppliers, partners and customers.”

What Australians want from brands after a breach

A survey of 1,000 Australians conducted by Sefiani through YouGov uncovered that a third of Australians said they would stop purchasing from an organisation that had been breached. However, among those who had actually been a customer of a breached brand, only around one in ten followed through.

According to Sefiani’s research, communications could be behind this loyalty. The single most influential factor keeping Australians loyal to an affected organisation is what it did to prevent another breach (39%). This came ahead of the seriousness of the breach (32%), the information affected (32%), and how transparent the brand was about what happened (30%). Australians want to be clearly informed of the remediation plan so they can trust another breach won’t take place.

The new Cyber Incident Playbook

According to Sefiani’s research and Shane Bell’s experience working at the front line of cyber incident response, the Cyber Incident Playbook needs to be revised at both ends of a breach.

Key steps to add to pre and post incident planning include: 

1. Align on how a ransom demand is managed ahead of time as part of general governance: This includes deciding how this decision would be communicated to staff and customers. Australia requires organisations to report a breach within 72 hours so the communications sequence cannot be worked out on the day.
2. Treat internal communications as an early priority, and continuous part of the comms cadence: When employees read about an incident in the media before they hear from you, trust goes and information can leak or speculation can become the story.
3. Publish your account of what happened on your own channels: Ensure it is a factual overview of what happened, what you did and what you have changed to make sure it doesn’t happen again. This is the source that AI draws from first.
4. Continue to monitor how AI is surfacing you: Be on top of what sources AI  is drawing from and what is surfaced at each stage of the customer journey. 

Sefiani works with Australian organisations on their cyber incident preparedness, from reviewing existing playbooks for the AI era to designing and running crisis simulations that test leadership teams under real pressure. Additional guidance, including how to work with media and industry bodies so your account of the incident is surfaced by the sources AI trusts, is available in full Cyber Breaches and Reputation Response in the AI Era report.