We’ve had a data breach… let’s not tell anyone

It’s a basic question in the face of a data breach: do we fix it and keep quiet? Or do we tell the world and risk the consequences. A major fuel company was recently confronted by this challenge, and their response and how they communicated it provides a worrying lesson for issue and crisis managers everywhere.

In November 2017, an unnamed person alerted New Zealand petrol company Z Energy that a “critical flaw” in its online fuel card system potentially exposed customer records, including names, vehicle registration details, where and when they bought petrol and, in some circumstances, even their home address.