📝 Workbook · Business · Unit 8

Workbook · 8B — Going public

← Back to Class Book
Exercise 1

Exercise 1 — Crisis-comms vocabulary

Complete each sentence with ONE phrase from the box.

Word bank — drag or tap, then tap a gap
  1. Issue the  drop  within two hours — we don't need every fact confirmed to say something.
  2. Route every press question through one  drop  — no comms from anyone else.
  3. The breach exposed 47,000 records — that constitutes a  drop , and the regulator has to be notified.
  4. Every affected user will receive a direct  drop  by 12:00 tomorrow.
  5. The full  drop  will be published within 14 days.
  6. She'd speak to us  drop , but not on the record.
Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 2

Exercise 2 — Reporting verbs

Complete each sentence with ONE of: acknowledge / confirm / admit / deny / refute / decline to comment.

  1. We can ___ that no payment data was accessed — the audit finished at 03:00.
  2. The CEO ___ that our internal review missed this vulnerability in April.
  3. The company ___ ___ ___ on the pending regulatory investigation.
  4. We ___ any suggestion that the data was sold — our logs show no external export. (STRONG — with evidence)
  5. We ___ that ~12,000 customer email addresses were exposed yesterday.
  6. The spokesperson ___ that any credit card data had been accessed.
Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 3

Exercise 3 — Lands or leaks?

Decide whether each statement LANDS (honest, specific, human) or LEAKS (hedged, corporate, worse than silence).

  1. 'We got this wrong. Your data was exposed for 4 hours. Here is what we're doing.'

  2. 'We are aware of reports of a potential incident affecting some users.'

  3. 'A configuration error exposed 12,000 email addresses. No passwords or payment data were affected.'

  4. 'We take the security of our users extremely seriously.'

  5. 'The affected parties will be contacted in due course.'

  6. 'Every affected user will receive a direct email by 12:00 tomorrow.'

Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 4

Exercise 4 — Rewrite the hedge as a statement

Rewrite each dodgy corporate line as a specific, honest reporting-verb sentence.

  1. 'We are aware of reports of a potential incident affecting some users.'
  2. 'We are looking into these matters and will provide an update in due course.'
  3. 'We take the security of our users extremely seriously.'
  4. 'We refute all allegations made in the press.'
Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 5

Exercise 5 — Three CEO statements about the same breach

You'll hear three drafts of the same public statement from Novavault. Decide which one earns back trust, which makes the story worse, and which is technically fine but still fails.

🎙️ Three drafts of the same CEO statement — Novavault breach — multi-voice

  1. Which statement earns back trust?
  2. Which statement makes the story worse than the breach?
  3. Which statement is technically fine and still fails?
Show transcript

Daniela (Diogo — hedging draft):We are aware of reports of a potential incident affecting some of our users yesterday afternoon. We take the security of our users extremely seriously. Our team is actively looking into these matters, and we will provide a further update in due course. — The Novavault team.

Omar (Sofia — the CEO):We acknowledge that approximately 12,000 customer email addresses were exposed between 14:02 and 17:56 CET yesterday, as a result of a configuration error which has now been fixed. We can confirm that no passwords, payment information or account balances were accessed. I want to be direct: we should have detected this faster — the alert that would have caught it had been misconfigured, and we are addressing that this week. Every affected user will receive a direct email by 12:00 tomorrow. A full post-incident report will be published within 14 days. — Sofia Duarte, CEO.

Carla (Beatriz — over-legal draft):It has been determined that a data exposure incident occurred on the platform yesterday. Appropriate steps are being taken to investigate the circumstances and remediate any weaknesses identified. The affected parties will be contacted in due course. Any further inquiries should be directed to press@novavault.pt. — Signed, the Communications Office.

Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 6

Exercise 6 — Draft the 3-sentence holding statement

Facts: at 14:02 yesterday, a configuration error at YOUR company exposed 12,000 customer email addresses for 3h 54min. No passwords or payment data involved. You will notify affected users within 24h. Draft the 3-sentence holding statement (max 80 words). Include: (1) ACKNOWLEDGE or CONFIRM + specific number and window, (2) explicit boundary ('no ___ was affected'), (3) ONE named next commitment with a specific time. Sign it with a real name and role.

Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers
Exercise 7

Exercise 7 — Case study reflection: Novavault

Think about the Novavault case (47,000 customers, email+name+truncated IBAN exposed for ~4h, reporter deadline at 12:00, false '500k' claim spreading). Answer the questions.

  1. Sequence your first four hours (09:00–13:00). What do you publish and in what order — and why that order?
  2. The anonymous X account is claiming '500k records'. Do you engage? What do you post?
  3. Legal wants you to soften 'we should have detected this faster' to 'we are reviewing our detection processes'. What do you say?
Important notes

Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.

Auto-saving
👩‍🏫 Ask the teacher · visible only to teachers