Breach Series # 5
The Human Side of a Cyberattack That Most Oklahoma Leadership Teams Overlook
You’ve already dealt with the breach.
Systems went down.
Jodi talked to the press.
Legal is asking questions.
Now there’s another problem forming… “The Employee’s Unknown”.
No One Told the Employees What’s Going On, So They Make Their Own Story, (YAY!)
Right now Leadership is focused on the high level concerns:
- Containment
- Legal exposure
- Communication Externally (with the news)
But inside the office… No one has addressed the employees. And when people don’t have information—
They create it.
They start asking questions internally. Assumptions are made. And before you know it, it grows into something much bigger than it started.
The Story Starts Writing Itself
“Hey… do you know what’s going on?”
From there, it builds…
Someone says they heard it was a breach.
By the end of the day, it sounds like this:
“They didn’t just get Jodi’s login… they cloned her email.”
“I heard they’re watching everything in real time.”
“Someone said they’ve been in our system for months—just waiting.”
And Then It Gets… Bigger
“I heard they already drained an account… they’re just not telling anyone yet.”
“They’re locking people out one by one so it doesn’t look obvious.”
“I think they shut the system down on purpose so we wouldn’t see what they were doing.”
Now We’re Fully Off the Rails
“My friend said this happened to another company and they lost everything overnight.”
“They can turn your computer on even when you’re not there.”
“They’re probably in the cameras too.”
None of this has been confirmed.
But it sounds close enough to the truth that it spreads, like butter on your bread.
The Close Enough Truth Leaves the Building
Let that sink in…
Your employees are now spreading what they’ve put together themselves about what happened to your company—
before you even notify the state attorney general, the media, or your clients.
This is where control is lost.
A text gets sent:
“I think we got hacked today…”
A message goes out to a friend in the industry:
“Jodi clicked a link and now I think our systems are compromised—don’t click on anything we send you!”
A quick post goes up:
“Systems are down at work… this is wild.”
These are not meant with ill intent.
Your employees do not have direction.
And without direction, they get lost…
Or represent your company like this on social media…
That’s Where Social Media Becomes a Problem
Employees aren’t getting answers from leadership, so they reach out to their friends… on social media.
“Did you guys experience any downtime yesterday? Was it just us?”
It only takes one post.
Your employee has just officially given the warning signs of a breach without even realizing it.
People will talk. It’s not a flaw. It’s reality.
Now the Questions Get Personal
At some point, the tone shifts.
Employees start asking:
Will this affect me too?
This is no longer about systems. It’s about people.
“Am I getting paid?”
“Was my information part of this?”
“Did someone here cause this?”
And the question no one wants to ask out loud:
“Is my job safe?”
The questions and speculation start again.
Do you see a pattern?
Don’t leave your employees in the dark. They will start turning on their own lights…
When Should You Address your Employees During Breach?
Most leaders think “We’ll address employees once we know more.”
But silence doesn’t buy you time.
It creates space.
And employees will fill that space with assumptions, conversations, and their own version of events.
Do not delay communication with your employees.
The more they KNOW, the less likely they are to speculate, and possibly damage your business’s credibility.
Employees don’t need every detail, but they do need direction.
Employees need to know:
- There has been a breach
- Leadership is aware
- What Employees are allowed to disclose publicly (Do not post on social media)
- We are working closely with our IT team to rectify
- Updates will be provided to the team as they become available to leadership.
The Real Question –
Are they repeating your message, or creating their own?
Coming Next Week… (Finale)
We’ve walked through:
- The breach
- The communication breakdown
- The operational impact
- The legal consequences
- And now—the internal response
Next week, we bring it all together.
How leadership teams prepare for this before it ever happens.
A Question for Leadership
If this happened inside your business—
Would your employees wait for direction?
Or start trying to figure it out themselves?
Would they protect your organization?
Or unintentionally expose it?
Or would you be managing…
A breach, a legal situation, and a workplace in panic—all at once?
Missed the other blogs in this series?
Breach Blog #1
Breach Blog #2
Breach Blog #3
Breach Blog #4