Orders are missing. Customers are asking questions. Online rumors begin spreading before the company fully understands what has happened.

Then investigators confirm ransomware.

In this episode of Behind the Breach, host Amber Wuollet follows a fictionalized ransomware scenario involving a major retailer as an internal incident becomes increasingly public. Employee and customer data is released online. Frontline employees are expected to answer questions while dealing with the exposure of their own personal information. Then the company’s private negotiation with the threat actor is leaked to the press.

She’s joined by Callum Laidlaw, Partner at Kekst CNC, to walk through the communications challenges that emerge over the following months—from early customer speculation and regulatory communications to data exposure, customer notifications, leaked negotiations, and the unexpected arrival of law enforcement.

Together, they explore how organizations can communicate under pressure without moving ahead of the facts, support employees who are both responders and victims, and maintain trust as new developments repeatedly bring the incident into public view.

In this episode:

• What organizations should be monitoring before a crisis begins
• Why communicating too quickly can create additional problems
• How communications teams work alongside legal counsel and regulators
• What customer-facing employees need to respond clearly and consistently
• How to support employees when their personal data is exposed
• How to respond when a private ransom negotiation is leaked
• Why organizations may be judged less for experiencing a cyber incident than for how they handle it

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident—and what organizations can learn before one happens to them.

Guest: Callum Laidlaw, Partner, Kekst CNC

Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell

Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.