When crisis communication meets forensics: managing narratives in ransomware, third-party, and nation-state attacks

Abstract

Crisis communication research within the domain of cyber has traditionally centered on data-breach events requiring communication with clients. Drawing on semi-structured interviews with eleven practitioners, this study provides a more nuanced understanding of the role of communication during cyber-related crises. Rather than functioning solely as a channel for informing stakeholders and employees, communication often becomes an operational instrument. The respondents describe how internal and external messages can influence ongoing ransomware negotiations, intensify pressure on third-party vendors when partners speak out, or complicate diplomatic or business relations in cases involving state-sponsored espionage. These dynamics illustrate that crisis communication is tightly intertwined with forensic processes, operational security, and strategic decision-making during negotiations. As such, the findings refine the applicability of established crisis communication frameworks in cyber contexts and broaden the field’s scope beyond its dominant focus on data-breach communication. They highlight the need for crisis communication scholarship to account for the distinctive mechanisms that shape communication during different types of cyber-related incidents.