A data breach and a product recall both require urgent communication, but the audiences, evidence, and safety actions differ. The response team should establish facts, contain harm, and coordinate notifications with the appropriate specialists. A press statement is one part of that work. It cannot replace individual notice, direct customer help, or a regulator-required recall process.
First establish the incident record
For a breach, the FTC recommends securing operations, assembling technical, legal, and communications expertise, preserving evidence, and identifying what information was affected. Do not say that no data was taken before the investigation can support it. For a product hazard, identify the affected model or lot, the risk, where it was sold, and the immediate action consumers should take. Product category and jurisdiction determine which authority must be involved.
Keep one approved chronology with source, timestamp, confidence, and owner for each fact. Give service staff the same current answers available to the media team. If a question has no answer yet, say what is under investigation and when you expect another update. Invented certainty can delay protective action and damage trust when a later notice contradicts the first.
Tell people what they can do
Breach notice
Describe the information involved, practical account or identity-protection steps, a reliable contact route, and how updates will be sent. Check applicable notice law with qualified counsel.
Recall notice
Identify the product clearly, the hazard, and how to stop using, return, repair, or replace it. Coordinate the approved remedy and public materials with the responsible authority.
Distribution
Use direct messages, the website, customer support, partners, and relevant social accounts to reach people who may not read a press release.
Follow-through
Publish corrections, response capacity, and progress on the fix. Avoid promising that a problem is fully resolved while investigation or recall fulfillment continues.
Plan legal and public duties together
The FTC notes that breach-notification duties differ by state and by the type of information involved. CPSC has specific reporting and recall procedures for consumer products; other products may fall under other agencies. This is not a universal deadline checklist. Have counsel and the appropriate regulatory lead identify duties for the incident and location, while communicators make the approved information understandable.
After containment, measure whether affected people actually received and understood the message. Track unanswered questions, failed delivery, support demand, and remedy completion. A positive sentiment chart is not a substitute for evidence that people are safer or better informed. Update the response plan using those findings before the next exercise.