When a company gets hacked, most people picture an IT problem: servers, passwords, and engineers working late. That picture is only half right. Every cyber incident is also a test of reputation: can people still trust this company. That question is exactly where the two worlds meet.

A hack is also a reputation problem

When we hand over our personal data, we expect the company to keep it safe. In a Gemalto survey of more than 10,000 consumers, most said the business holding their data is mainly responsible for protecting it, and 70% said they would stop doing business with a company after a breach.

A damaged reputation has a price. IBM estimates that lost business, revenue and customers cost a breached organization USD 1.38 million on average. Attackers know how much reputation matters: in IBM's 2025 report, 41% of ransomware victims said attackers threatened to damage their brand reputation to pressure them into paying. In other words, reputation itself has become a target.

Security facts become public messages

Companies cannot keep a serious breach quiet, and often the law says they must not. In Indonesia, the Personal Data Protection Law requires companies to inform affected people and the regulator within 3x24 hours. Europe's GDPR sets a similar 72-hour window for notifying the authorities.

So the findings of a technical investigation quickly turn into public statements, and those statements shape a company's reputation. The UK's National Cyber Security Centre (NCSC) notes that organizations often focus on the technical response and treat communication as an afterthought, even though communication shapes how they are perceived.

Honesty protects reputation

No organization is immune to attack, and the public increasingly knows it. A company's reputation is judged less by the breach itself than by how it behaves afterwards. NCSC UK advises that public messages be factual and clear, without downplaying the incident.

Reputation can also be rebuilt. In a 2022 survey, 81% of respondents would keep using a brand once it had fixed the problem behind the breach. Fixing the problem is the security team's job; making sure people know it was fixed is the communicator's.

Two teams, one reputation to protect

Because of this overlap, security agencies now encourage companies to involve their communications staff early and build communication into their incident plans. NCSC UK notes that good communication during an incident helps organizations maintain trust with stakeholders and counter potential reputational damage.

The lesson for all of us is simple. Cybersecurity is not only about keeping attackers out, and public relations is not only about good headlines. Both exist to protect the same thing: an organization's reputation and the trust of the stakeholders it serves.

Sources

• Majority of consumers would stop doing business with companies following a data breach — Thales/Gemalto
• Consumer survey on data breaches (2017) — Thales/Gemalto
• What is a data breach. — IBM
• IBM Cost of a Data Breach report coverage — Infosecurity Magazine
• Corporate steps after a personal data breach under UU 27/2022 — Hukumonline
• GDPR Article 33: breach notification — GDPR-Text
• Guidance on effective communications in a cyber incident — NCSC UK
• Seven things every chief exec needs to know in a cyber attack — ITPro
• Data breaches leave customers very shaky — Malwarebytes
• Communicating in a cyber security incident — NCSC New Zealand