Business · Unit 8 · Case study

Case study: 'Communicating a data breach to customers and press'

Duration: 20 min

Apex← Back to Business contents
← Lesson 8ALesson 8B →
Warm-up

Warm-up · Prime the case (5 min, solo)

Two micro-drills from 8A (the passive + incident/post-mortem vocab) and 8B (reporting verbs + PR / crisis-comms register). Do both before opening the scenario.

Drill 1 — Passive, without hiding behind it

Rewrite each line in the passive so it names WHAT happened without dodging accountability. Add ONE clause that says who is now responsible.

  1. 'We were hacked.'

  2. 'Someone left the S3 bucket open.'

  3. 'Passwords got leaked.'

Drill 2 — Reporting verb, right weight

Replace each 'said' with the most accurate reporting verb (admitted / confirmed / denied / declined to say / clarified / apologised for). Different verbs carry different legal + reputational weight — pick with care.

  1. 'The CEO SAID the breach happened three weeks ago.'

  2. 'The company SAID sorry to affected customers.'

  3. 'The spokesperson SAID they don't know how many records were taken.'

Bridge to the case → Two moves the case will demand: (a) the passive names the incident; an active sentence right after it names the owner and the next step; (b) every reporting verb is weighed for legal + reputational load — 'confirmed' vs 'admitted' vs 'declined to specify' land very differently. Open the scenario.
🎯 Final output

Final output — the holding statement + the customer email + the correction post

Solo. (1) Write the CEO's 3-sentence public holding statement (80 words max) — signed by Sofia. (2) Write the customer notification email to affected users (120 words max) — first line = 'you were affected', last line = exactly what to do next. (3) Write the ONE-tweet correction of the anonymous '500k' claim (280 characters max) — calm, factual, and finishes with the boundary line. Every document has to answer: what do we KNOW, what's the BOUNDARY, and what SPECIFIC TIME will we say more?