The mistake is rarely the incident. It’s what leadership says, or doesn’t say, in the hours after.
Most organisations don’t fail for lack of a plan. They fail because the plan gets run by the wrong people, at the wrong pace, in the wrong tone. That’s a leadership failure, not a paperwork one.
The rule is simple to state and hard to follow: say what’s true, say it yourself, and say it before someone else does.
Qantas’s 2025 data breach shows the gap between the two: compliance handled well, and the bill still arrived. How Qantas handled the customer-facing side of that breach is worth reading alongside this.
The Author – Peter Wilkinson
The Reality Check
The first 24 hours decide most of what follows: contain the facts, name one voice to speak, and say only what’s actually confirmed.
Qantas detected unusual activity on a third-party customer servicing platform on Monday, 30 June 2025. It went public on 2 July.
The platform held records for up to six million customers. The privacy regulator, the OAIC 1, later put the number of Australians affected at about 5.12 million.
Chief executive Vanessa Hudson apologised publicly. Qantas worked with the National Cyber Security Coordinator and the Australian Cyber Security Centre, notified affected customers from 9 July, and ran a support line 24 hours a day.
Knowing how to deal with a crisis means running two clocks at once: compliance and communication. One never substitutes for the other. Both clocks start in the golden hour in a crisis.
Five Mistakes, Named
In 24 years advising boards through cyber attacks, product recalls and judicial inquiries, I’ve watched the same five crisis communication mistakes repeat, regardless of sector.
Between them, they separate organisations that know how to handle a crisis from those that only know how to handle a press release.
Use the same test when choosing a crisis PR agency in Australia: genuine crisis experience, not general PR skill.
1. The Reassurance Trap
Reaching for reassurance before the facts justify it.
Qantas said early there was “no impact to Qantas’ operations or the safety of the airline.” Fair, and accurate, but the data exposure was still being scoped. Blanket reassurance this early risks a second statement that contradicts the first.
Weak: “There is no cause for concern, and we have the situation fully under control.” Strong: “Flight operations and safety are unaffected. We’re still establishing the scope of the data involved.”
That’s where genuine crisis communications discipline earns its fee. Not drafting the holding line. Pressure-testing it against the question a newsroom asks an hour later.
2. Mistaking Compliance for Communication
Treating regulatory obligations as the finish line, not the starting point.
Qantas met its obligations, and the regulator later agreed. In July 2026, the OAIC closed its preliminary inquiries without opening a formal investigation, saying the evidence did not support the likelihood of a breach of privacy law.
But compliance was never what customers wanted to know. They wanted to know what happened to their data, and what happens next.
Three messages have to land in a crisis: the incident message, the company message, and the personal message from the leader, in their own words. Skip the third, and the other two read as legal cover.
3. The Committee-Run Response
Slower, less visible, and the most damaging mistake over time.
Every sentence gets workshopped by six departments before it reaches the public. The chief executive becomes one voice among many, not the one in charge. A crisis moves in hours. A committee moves in cycles.
Strategy and tactics are different jobs. Strategy decides to lead with customer impact, not company position. Tactics are the emails and lines that carry it out. A committee can draft tactics. It shouldn’t set strategy in real time.
Senior counsel belongs in the room before an event, not assembled after one. An ongoing arrangement, like Wilkinson Confidante, keeps that authority already in place.
4. The Untested Spokesperson
An unrehearsed voice freezes on the first hostile question. The freeze becomes the story.
A spokesperson tested against real questions beforehand is the cheapest insurance an organisation can buy. That’s why media training sits alongside crisis planning, not after it.
Continuity matters too. The adviser who prepared the spokesperson should be in the room when the cameras arrive. That can’t be improvised once they’re outside.
5. Assuming the Story Ends When the Headlines Do
It doesn’t. Once a crisis is public, the job shifts from containment to consistency: the same message, from the same voice, every time it’s asked.
The board kept score. It cut 2024/25 short-term bonuses for the chief executive and executive management by 15 percentage points, a reduction worth $250,000 to Hudson.
Less than a year later, the regulator closed its inquiry. The bonus cut still stood. Compliance and reputation run on different clocks, and only one of them forgives.
How an incident is handled becomes a permanent part of the record. Reputation management and crisis response aren’t separate jobs. They’re the same job on a longer timeline.
Timing and Resourcing
None of this works filed in a drawer. Manage a crisis without a rehearsed plan, and the job defaults to whoever’s calmest in the room. That’s luck, not strategy.
Senior counsel gets retained before an incident, not sourced during one. That’s resourcing. The spokesperson sits through a hostile mock interview months out, not on the day. That’s timing.
The same readiness is the entire point of proactive issues management, not something bolted on after a story breaks.
Most boards under-budget for this. Judgement can’t be bought after the headline breaks. It has to be retained before it.
What the Framework Can’t Do
I ask every client one question before we draft a word: what will the newsroom ask an hour from now? A framework doesn’t answer that. Judgement does.
The test underneath all five mistakes is Trust = Truth + Transparency + Traceability, the standard every Wilkinson Group engagement is held to:
- The Reassurance Trap: reassuring on everything before the facts justify anything.
- Mistaking Compliance for Communication: the obligation treated as the whole job, not the first third.
- The Committee-Run Response: consensus replacing continuity of judgement.
- The Untested Spokesperson: an unrehearsed voice meeting a hostile question.
- Assuming the Story Ends When the Headlines Do: reputational cost treated as a media-cycle problem.
Each traces back to the same failure: truth stated too early, transparency limited to the legal minimum, or a decision nobody can trace to a named person in the room.
None of this is hard to name. It’s hard to avoid under pressure, which is why unrehearsed organisations keep repeating all five.
The lesson isn’t a better statement. It’s someone in the room, before the crisis, who has seen the pattern often enough to interrupt it.
