CRISIS MANAGEMENT · FINANCIAL SERVICES
A European banking institution suffers a successful cyberattack on a system containing customer data. The incident is technically stabilized. The remaining question is no longer technical.
It is this: what should we say now, and how will that decision be interpreted by customers who do not all have the same relationship with money, data and the institution ?
TOO LITTLE
Silence is read as concealment
TROP
Precision can amplify perceived severity
TOO LATE
The information is reliable, but trust is already damaged
THE PROBLEM
The incident is contained, but the organization must simultaneously balance the speed of communication, the degree of transparency, the level of detail disclosed, acknowledgment of responsibility, protection of its reputation, reassurance of its customers, regulatory risk and the risk of media amplification.
These trade-offs do not cancel one another out. Saying too little creates distrust. Saying too much can amplify perceived severity. Waiting makes the information more reliable, but can be read as concealment.
The question is therefore not: how do we reassure ? It is: which response actually protects trust when it is reassessed several weeks later ?
TIMING
The legal notification window extends to 72 hours. The window customers actually tolerate in the simulated reactions is shorter: beyond 48 hours, the content of the communication no longer offsets the delay.
T0
The attack is detected internally. The exact extent of the exposure has not yet been established.
T + A FEW HOURS
The incident becomes public. The organization must decide what to say, to whom, and with what level of detail.
T + 24 HOURS
Customers, media and social networks interpret the response as much as the incident itself.
T + A FEW DAYS
Initial perceptions begin to settle. What was not said becomes more costly to disclose.
T + SEVERAL WEEKS
Trust is restored or deteriorates over time, depending on the consistency between what was announced and what was done.
THE SIMULATION
The five strategies were tested against the same population to isolate the effects of timing, level of detail, acknowledgment of responsibility and the protection measures announced.
SIMULATED POPULATION
The reconstructed population covers the institution's retail and business customers, combining actual exposure to the incident, type of banking relationship, intensity of digital use, sensitivity to data and tenure.
These dimensions, rather than an average opinion about cybersecurity, determine how the same sentence is received.
DIRECTLY EXPOSED CUSTOMERS
their data falls within the scope of the incident
CUSTOMERS NOT AFFECTED BUT INFORMED
learn about the incident through the media without knowing whether they are affected
BUSINESS CUSTOMERS
financial exposure and responsibility toward their own customers
HEAVY APP USERS
daily dependence on the bank's digital services
LOW-DIGITAL CUSTOMERS
limited technical understanding, high dependence on an adviser
PEOPLE WHO HAVE PREVIOUSLY EXPERIENCED FRAUD
memory of a previous incident, lower tolerance threshold
HIGH TRUST CAPITAL
long-standing relationship, stable relationship with the institution
PRE-EXISTING DISTRUST
distrust of financial institutions that predates the incident
HIGHLY SENSITIVE TO PERSONAL DATA
high vigilance regarding data use and protection
These configurations reveal part of the population's heterogeneity. The simulation operates on synthetic individuals, not a handful of persona types.
REACTIONS
SILENCE IS NOT NEUTRAL: IT IS INTERPRETED
In the simulation, waiting does not suspend judgment; it shifts it. Every hour without an official statement leaves room for other narratives, and caution becomes readable as concealment.
PARTIAL TRANSPARENCY IS READ AS OMISSION
Fast but evasive communication reassures some customers and sharply worsens the position of others, who cross-check the available information. Perception deteriorates more than in the silence scenario.
ACKNOWLEDGING WHAT IS NOT YET KNOWN INCREASES CREDIBILITY
Counterintuitively, explicitly stating what remains unknown strengthens the credibility of the rest of the message. Acknowledged uncertainty is better tolerated than certainty that later proves false.
ACTIONS CARRY MORE WEIGHT THAN REASSURING WORDS
An apology-led message generates markedly lower support than one centered on protection measures actually put in place. Customers who were already distrustful respond only to evidence of action.
Imagine All The People does not simply ask a model to imagine how customers might react to a cyberattack. Several crisis responses are tested against a coherent, heterogeneous synthetic population to observe reactions, contradictions and differences between segments before the decision is made.
RESULT
Comparative reading based on simulated reactions. No response eliminates the risk: transparency combined with protection measures produces the most robust trajectory, but makes the initial severity clearer and commits the organization to verifiable actions over time.
THE MOST ROBUST
Speak quickly acknowledge uncertainty provide concrete protection
THE MOST FRAGILE
Wait downplay reassure without evidence
TAKEAWAY
In the simulation, reassuring messages do not produce lasting trust: they create an expectation that the facts confirm or contradict a few days later. What holds over time are verifiable elements — what is known, what is not yet known, what is being put in place, and for whom.
Silence is not an absence of communication. It is already a message, and customers interpret it using other sources.
POSSIBLE FUTURES
A
ATTENDRE
Communicate once the incident has been fully assessed
B
RASSURER
Speak quickly, present the incident as limited
C
SAY + ACT
Established facts, acknowledged uncertainty, immediate protection measures
METHOD
This case differs from the previous ones because of its constraint: the decision could not be prepared in advance. The study was conducted under pressure, in parallel with the technical management of the incident, to inform a trade-off that had to be made that day.
This case is based on a completed simulation. The institution is not named, and no element that could identify the incident or the client is published. The decision, the strategies tested and the findings are presented without revealing sensitive information.
Your next decision
Describe your need. We can point you to the right level of support.
State your decision. See the future it produces.
