What Are the Most Common Crisis Communications Mistakes?

The mistake is rarely the incident. It’s what leadership says, or doesn’t say, in the hours after.

Most organisations don’t fail for lack of a plan. They fail because the plan gets run by the wrong people, at the wrong pace, in the wrong tone. That’s a leadership failure, not a paperwork one.

The best approach for a leader in a crisis is simple to state and hard to do: say what’s true, say it yourself, and say it before someone else does.

Crisis communications protects an organisation’s decisions and its reputation while the facts are still moving. Knowing how to deal with a crisis means keeping both clocks running at once, not treating one as a substitute for the other. A closer look at how Qantas handled the customer-facing side of that breach shows the same pattern play out in real time.

The first 24 hours decide most of what follows: contain the fact, name one voice to speak, and say only what’s actually confirmed.

Qantas confirmed in July 2025 that a cybercriminal had accessed a third-party platform holding data for around six million customers.

The breach was detected on Monday, 30 June. Qantas went public two days later. CEO Vanessa Hudson apologised directly, including in a Friday interview from an overseas trip.

The airline notified the OAIC under the Notifiable Data Breaches scheme, plus the National Cyber Security Coordinator, the ACSC, and the AFP, given the incident’s criminal nature.

The compliance basics were handled well. That’s exactly why this case is useful: getting the paperwork right and getting the communications right turned out to be two different jobs, on two different clocks. Knowing how to deal with a crisis means keeping both clocks running at once, not treating one as a substitute for the other.

In 24 years advising boards through cyber breaches, product recalls and executive misconduct allegations, I’ve watched the same five mistakes repeat, regardless of sector. Between them, they’re what separates organisations that genuinely know how to handle crisis management from those that only know how to handle a press release. It’s the same test worth applying when choosing a crisis PR agency in Australia: genuine crisis experience, not general PR skill, is what separates the two

1. The Reassurance Trap

Reaching for reassurance before the facts justify it.

Qantas said early there was “no impact to Qantas’ operations or the safety of the airline.” Fair, and accurate. But the data exposure was still being scoped. Blanket reassurance this early risks a second statement that contradicts the first.

Weak: “There is no cause for concern, and we have the situation fully under control.” Strong: “Flight operations and safety are unaffected. We’re still establishing the scope of the data involved.”

That’s where genuine crisis communications discipline earns its fee. Not drafting the holding line. Pressure-testing it against the question a newsroom asks an hour later.

2. Mistaking Compliance for Communication

Treating regulatory notification as the finish line, not the starting point.

Notifying the OAIC and the ACSC satisfies the law. It doesn’t answer what every customer actually wants to know: what happened to their data, and what happens next.

Three messages have to land in a crisis. The incident message. The company message. The personal message, from the leader, in their own words. Skip the third, and the other two read as legal cover.

3. The Committee-Run Response

Slower, less visible, and the most damaging mistake over time.

Every sentence workshopped by six departments before it reaches the public. The chief executive becomes one voice among many, not the one in charge. A crisis moves in hours. A committee moves in cycles.

Strategy and tactics are different jobs. Strategy decides to lead with customer impact, not company position. Tactics are the emails and lines that carry it out. A committee can draft tactics. It shouldn’t set strategy in real time.

Senior counsel belongs in the room before an event, not assembled after one. An ongoing arrangement, like Wilkinson Confidante, keeps that authority already in place.

4. The Untested Spokesperson

An unrehearsed voice freezes on the first hostile question. The freeze becomes the story.

A spokesperson tested against real questions beforehand is the cheapest insurance an organisation can buy. That’s why media training sits alongside crisis planning, not after it.

Continuity matters too. Clients get direct access to the person advising them, not a rotating account team. That can’t be improvised once the cameras are outside.

5. Assuming the Story Ends When the Headlines Do

It doesn’t. Once a crisis is already public, the job shifts from containment to consistency: the same message, from the same voice, every time it’s asked.

Qantas’s board cut short-term bonuses for the CEO and executive management by 15 percentage points in the FY2024/25 annual report, the same year’s results covering the breach. The reputational cost outlasted the news cycle by months.

How an incident is handled becomes a permanent part of the record. Reputation management and crisis response aren’t separate jobs.

None of this works filed in a drawer. Manage a crisis without a rehearsed plan, and the job defaults to whoever’s calmest in the room. That’s luck, not strategy.

Senior counsel gets retained before an incident, not sourced during one. That’s resourcing. The spokesperson sits through a hostile mock interview months out, not the same day. That’s timing.

Most boards under-budget for this. It’s not bought after the headline breaks. It’s judgment retained before it, set out further on Peter Wilkinson’s background page.

I ask every client one question before we draft a word: what will the newsroom ask an hour from now? A framework doesn’t answer that. Judgment in the room does.

The test underneath all five mistakes is Trust = Truth + Transparency + Traceability. Every failure above traces back to one of the three: truth stated too early, transparency limited to the legal minimum, or a decision nobody can trace to a named person in the room.

1. The Reassurance Trap: reassuring on everything before the facts justify anything.
2. Mistaking Compliance for Communication: the notification as the whole job, not the first third.
3. The Committee-Run Response: consensus replacing continuity of judgment.
4. The Untested Spokesperson: an unrehearsed voice meeting a hostile question.
5. Assuming the Story Ends When the Headlines Do: reputational cost treated as a media-cycle problem.

None of this is complicated to name. It’s hard to avoid under pressure. That’s why unrehearsed organisations repeat the same five errors, in the same order, every time.

The lesson isn’t a better statement. It’s someone in the room, before the crisis, who’s seen the pattern enough times to interrupt it.