Scenario

You are the new director of communications at Big-Box. The company’s CEO, Anne Nagata, has asked you to conduct a post-incident analysis of a recent crisis. She has provided the following details about the crisis response:

• In 2017, a data security journalist revealed that Big-Box’s IT systems had been hacked, exposing the data of up to one million customers who had shopped at Big-Box during that year.
• In response to this story, a crisis communication team consisting of the CEO, the director of communications, and the head of information security was convened.
• As soon as the story was revealed, the previous director of communications urged the CEO to immediately make a formal statement describing the incident and outlining steps that were taken to address the issue. Because of the size and perceived severity of the data breach, this statement was issued before Big-Box could confirm the total number of customers affected by the breach. Although Big-Box operates Facebook, Instagram, and Twitter accounts, this press release was posted only on the company website. In a prepared press release, Anne, speaking on behalf of the organization, apologized for the data breach and offered a plan for affected customers to access credit-monitoring services at Big-Box’s expense.
• After the statement was issued, a reporter revealed that the actual data breach had been broader than previously reported and that there was reason to believe that data from up to five million customers had been exposed.
• On review of this additional information, Big-Box determined that the breach had been larger than originally reported and confirmed the reporter’s findings. Due to this new information, Big-Box was forced to retract its previous statement. Big-Box issued a second statement accounting for the newly revealed numbers and extended the benefits outlined in the company’s original statement.
• Throughout the crisis, Big-Box’s social media accounts were not monitored, so press releases regarding the incident were not distributed on social media platforms. Since there was no official statement, Big-Box’s social media accounts were flooded with aggrieved customers demanding action.
• All press releases from Big-Box were posted on the Big-Box website. However, they were posted to the press section of the website and were not easily found by members of the public. Additionally, these responses consisted solely of text documents. The Big-Box communication team did not create videos or infographics for distribution.
• No information regarding the incident was posted on company’s social media accounts, as Big-Box does not have a social media manager, and corporate accounts are monitored by the director of communications.

Having been presented with the facts of the Big-Box data breach, you will create a post-incident analysis that describes the crisis, analyzes the obstacles or missteps that occurred during the crisis, and assesses the roles of the stakeholders involved in the crisis. You will also make recommendations for future adjustments to the company’s crisis communication plan.

Directions

• Describe the Crisis: Anne has asked you to open your analysis with a description of the crisis. In this part of your analysis, briefly summarize the sequence of events in the crisis and include all of the steps taken by the response team.
• Analyze the Obstacles: In your analysis, describe the specific obstacles or missteps that occurred during the crisis and in the company’s response. In this analysis, be sure to address the following:
  • Describe specific obstacles and missteps that occurred during the crisis and determine whether they were handled appropriately and effectively. In your analysis, consider the following:
    • Were communications from Big-Box timely, credible, and transparent?
    • Were all aspects of the crisis response effective?
    • Did members of the Big-Box team use all tools available to them (TV and radio interviews, infographics, etc.) to address the crisis? If not, detail additional tools that could have been used.
  • If situations were mismanaged, how could they have been managed more appropriately and effectively? In your analysis, cite specific situations from the crisis response and offer concrete suggestions for how these obstacles could have been handled more effectively.
• Assess Stakeholder Roles: Throughout the crisis, various stakeholders were involved in addressing issues and responding to the public. In your analysis, describe the roles of and actions taken by these stakeholders and determine the appropriateness of their role.
• Future Needs: For the final component of your analysis, Anne has asked you to make recommendations for additional steps to be integrated into the company’s crisis communication plan.

What to Submit

Every project has a deliverable or deliverables, which are the files that must be submitted before your project can be assessed. For this project, you must submit the following:

Post-Incident Analysis
Create a post-incident analysis for Big-Box, analyzing the company’s response to a recent data breach incident. This analysis must be 1,000 to 1,500 words in length. Cite any and all references appropriately.

Supporting Materials

The following resource(s) may help support your work on the project:

Citation Help
Need help citing your sources? Use the CfA Citation Guide and Citation Maker.

Document: Big-Box Crisis Communication Plan

Review this excerpt from Big-Box’s crisis communication plan