What are common mistakes in crisis communication?

When Qantas confirmed in mid-2025 that a cyber criminal had accessed a third-party platform holding data for six million customers, the airline moved quickly on the basics.

Qantas says it detected unusual activity on Monday 30 June 2025, and ABC reported Vanessa Hudson apologising to customers on Friday 4 July 2025 after breaking from her European holiday.

The OAIC confirmed Qantas had notified it under the Notifiable Data Breaches scheme, and said Qantas was working with the National Cyber Security Coordinator, the ACSC, and cyber experts. The AFP was also notified because the incident was criminal in nature.

That is the part most organisations get wrong, and it is worth stating early. The mistake in a crisis is rarely the incident itself. It is what leadership says, or fails to say, in the hours that follow.

Wilkinson has spent 24 years advising boards and chief executives through cyber breaches, product recalls and executive misconduct allegations, and the pattern repeats regardless of sector. Most organisations do not fail because they lack a plan. They fail because the plan is executed by the wrong people, at the wrong pace, with the wrong tone. Five mistakes account for almost all of it.

The first is reaching for reassurance before the facts justify it. Qantas told customers early there was “no impact to Qantas’ operations or the safety of the airline,” a fair and accurate statement about flight safety. However, the scale of the data exposure was still being established, and organisations that lead with blanket reassurance before the picture is clear risk a second announcement that contradicts the first.

This is where a genuine crisis communications consultant in Sydney earns their fee, not by drafting the holding statement, but by pressure-testing it against the questions a newsroom will ask an hour later.

The second mistake is treating regulatory notification as the finish line rather than the starting point. Notifying the OAIC and the ACSC satisfies a legal obligation, but it does not answer the question every affected customer is actually asking: what happened to their information, and what happens next.

Boards often assume that once legal, IT and the regulator are satisfied, the communications job is largely done. It is not, because legal obligations and reputational obligations run on different clocks and answer to different audiences. A crisis has three separate messages that need to land: the incident message (the facts and the timeline), the company message (what this says about the organisation’s values and commitment) and the personal message (the leader’s own account of how they feel and what they intend to do). Skip the third, and the first two read as legal cover, however accurate they are.

The third mistake is slower and less visible, but it does the most damage over time. It is the committee-run response, where every sentence is workshopped by six departments before it reaches the public, and the chief executive becomes one voice among many rather than the person clearly in charge. A crisis moves in hours, not committee cycles, and continuity of judgment matters more than consensus.

Organisations need to have senior counsel in place before an event, rather than assembled after one. An option is to build it through an ongoing arrangement like Wilkinson Confidante.

The fourth mistake sits underneath the third. Spokespeople who have never faced a hostile question freeze the first time one lands, and the freeze becomes the story. A prepared spokesperson, tested against real questions before a crisis arrives, is one of the cheapest insurance policies an organisation can buy, which is why media training belongs alongside crisis planning rather than after it.

At Wilkinson Group, clients get direct access to the person advising them, not a rotating account team, and that is deliberate. Continuity of that kind cannot be improvised once the cameras are already outside the building.

The fifth mistake is treating the crisis as a discrete event that ends when the media cycle moves on. It does not. Qantas reduced its chief executive’s short-term bonus by 15 per cent in the following year’s annual report, a signal that the reputational cost of the breach outlasted the news cycle by months.

How an incident is handled becomes a permanent part of an organisation’s record, which is why reputation management and crisis response cannot be treated as separate disciplines run by separate teams.

For CEOs weighing up how much senior counsel their organisation actually needs, the answer is more than most budget for. It is not a service bought after the headline breaks. It is judgment retained before it does, and that judgment is detailed further on Peter Wilkinson’s background page.

None of these mistakes are complicated to name. They are difficult to avoid under pressure, which is exactly why organisations that have never rehearsed a crisis tend to repeat the same five errors, in roughly the same order, every time.

The lesson is not to write a better statement. It is to have someone in the room, before the crisis, who has seen this pattern enough times to interrupt it. It’s an investment, not a cost.

If in doubt about spending money, don’t; if in doubt about communicating, do.