A company should say what it has confirmed, what it has not confirmed yet, what affected people should do now and when the next update comes. The SEC requires public companies to file generally four business days after they determine an incident is material, so the first 24 hours go to confirmed facts and the materiality decision. IBM puts the average breach cost at $4.99 million.
Last updated: November 2, 2026
In this guide
- When does the SEC disclosure clock start after a breach?
- Which other notification deadlines apply?
- What does the cost data say about speed?
- What should happen in the first 24 hours?
- What belongs in a holding statement?
- How do you speak to each audience?
- Where should the incident page live?
- What do past breaches teach?
- What support should affected people get?
- Who should review the statement before it goes out?
- Frequently asked questions
- Conclusion
When does the SEC disclosure clock start after a breach?
The SEC clock starts when a public company determines that a cybersecurity incident is material, not when the company discovers it. The SEC's 2023 rule added Item 1.05 to Form 8-K, and the filing must describe the material aspects of the incident's nature, scope and timing, plus its material impact.
The only built-in delay is narrow: the filing can wait if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and tells the SEC in writing. Materiality is a legal judgment, so counsel owns the call and communications supplies the language.
That makes the first communications task a question of process. Someone must be named to make the materiality decision, and the people who draft the statement must know when that decision is made.
Which other notification deadlines apply?
Notification deadlines depend on where the affected people live and what kind of company you are, so identify them on day one. The table lists the rules most breaches trigger, and counsel confirms every deadline before a notice goes out.
| Rule | Who it covers | Deadline |
|---|---|---|
| GDPR | Organizations handling personal data of people in the EU | Notify the supervisory authority within 72 hours of becoming aware of the breach |
| California Civil Code 1798.82, as amended by SB 446 | Businesses holding personal information of California residents | Notify residents within 30 calendar days of discovery, effective January 1, 2026. For breaches affecting more than 500 residents, send the Attorney General a sample notice within 15 days of notifying residents |
| SEC Form 8-K, Item 1.05 | Public companies | Report material cybersecurity incidents within four business days of determining the incident is material |
| Other state laws | Businesses holding data of residents of each state | Deadlines vary by state, and regulated sectors can face shorter ones |
California and several other states allow delay when law enforcement asks for it or when the scope of the breach must be determined. Build the deadline list for every state and country where affected people live, because the shortest deadline sets the pace of the first notice.
What does the cost data say about speed?
IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record $4.99 million, based on 602 organizations studied between March 2025 and February 2026. One in four malicious breaches in the study was AI-enabled, and those breaches averaged $6 million.
Suja Viswesan, vice president of IBM Security Software, said in the release that a long gap between discovery and remediation shows up directly in breach costs. Her point concerns technical response. The same logic applies to approvals: a holding statement that is still waiting on sign-offs late in the first day is a gap of its own. 5W's research on the shareholder cost of weak crisis communications, The Crisis Tax, covers the investor side.
What should happen in the first 24 hours?
The first 24 hours should produce four things: an incident log with one named decision owner, a holding statement with confirmed facts only, a list of affected audiences, and a live incident page with a set time for the next update. The table below orders that work.
| Window | Actions | Output |
|---|---|---|
| Hours 0 to 4 | Open an incident log, name one decision owner, bring in counsel, the security lead and the communications lead, and pause outside statements | Incident log and approved contact list |
| Hours 4 to 8 | Draft a holding statement from confirmed facts only, and draft an employee notice | Holding statement, first version |
| Hours 8 to 16 | List affected customers, employees, partners and regulators, and prepare notice drafts with counsel | Audience list and notice drafts |
| Hours 16 to 24 | Publish a dated incident page, brief customer support and executives, and set the next update time | Live page, support script, update schedule |
What belongs in a holding statement?
A holding statement states what happened in confirmed terms, what the company is doing, what affected people should do now, and when the next update arrives. Each line should be something security and counsel have confirmed.
- Leave out the cause, the attacker and any record count until security confirms them.
- Name the company and the systems involved, not "the incident" or "the matter."
- Give a specific time for the next update and keep it.
A number that changes later becomes the headline, so a smaller confirmed statement protects the company more than a larger guess. Illustrative scenario: at 9 a.m. a retailer's security team confirms that a vendor account exported customer email addresses. The holding statement names the vendor system, says passwords were not part of the export, tells customers to watch for phishing messages, and promises an update at 5 p.m.
How do you speak to each audience?
Each audience needs the information it can act on, in plain language, and the message should stay consistent across all of them. The table shows what each group needs and how to deliver it.
| Audience | What they need | How to deliver it |
|---|---|---|
| Customers | Clear, actionable information | Plain language, specific protection steps, support resources, consistent updates |
| Employees | Their role in the response, how to handle customer questions, messaging guidelines | An internal briefing before the public statement |
| Media | One accurate source | Designated spokespeople, prepared statements, regular updates, fact sheets |
| Regulators and shareholders | Required disclosures on time | Notices drafted with legal counsel |
Explain technical concepts in simple terms, focus on the details that matter to the reader, and put deeper technical detail in separate documentation. 5W's cybersecurity PR team handles this balance for technology companies.
Where should the incident page live?
The incident page should live on the company's own domain, dated and updated at the times it promised. Reporters and AI assistants that answer "was this company breached" retrieve whatever pages exist, and a current official page gives them one source for the confirmed facts instead of leaving older coverage to fill the gap. The reasoning behind that is covered in how PR, SEO and GEO work together.
Keep the page factual and add a time stamp to every update. Link the page from the home page and from the support script so customers reach the same words the press sees. 5W's second crisis analysis covers how teams audit those answers after publication.
What do past breaches teach?
Three well-known breaches show how prompt acknowledgment, regular updates and detailed disclosure shape the response. The table gives each company's year, what it did and the lesson for a first statement.
| Company | What happened | Lesson |
|---|---|---|
| Capital One, 2019 | Acknowledged the incident quickly, said about 100 million customers were affected, and described immediate security actions | Give a number and an action in the first statement |
| Microsoft, July 2023 | Disclosed a breach affecting email accounts, gave regular updates and offered specific guidance | Update as facts emerge |
| Marriott, 2018 | A breach affecting up to 500 million guests. The first communication was prompt but lacked detail, later updates were fuller, and the company opened a dedicated website for guests | Prompt is not enough without detail |
What support should affected people get?
Affected people should get practical protection and a way to reach someone. Offer credit monitoring, identity theft protection, dedicated support channels and regular status updates.
After the immediate crisis, track the response through media coverage analysis, social monitoring, customer feedback and stakeholder engagement. Share lessons learned, document process improvements and update security measures. The crisis PR guide covers templates and response-team structure.
Who should review the statement before it goes out?
Counsel should review every outside statement before release, because the same words reach regulators, customers, employees and reporters at once. Teams that expect litigation can read how litigation PR during legal cases works alongside counsel.
Agreeing on the agency, the retainer and the approval path before an incident saves days after one. Crisis PR retainers and emergency rates explains how agencies price that work, and choosing a cybersecurity PR agency lists the questions to ask first. For brand-level data, see the 5W AI Cybersecurity Visibility Index and the Cybersecurity edition of the Retrieval Index. 5W's crisis communications practice builds these plans for clients.
Frequently Asked Questions
How long does a public company have to disclose a data breach?
Generally four business days after it determines the incident is material, under the SEC's 2023 rule and Item 1.05 of Form 8-K. The clock starts at the materiality determination, not at discovery.
What deadlines apply to a data breach notice besides the SEC?
GDPR requires notice to the supervisory authority within 72 hours of becoming aware of a breach, and California requires notice to residents within 30 calendar days of discovery from January 1, 2026. State deadlines vary, so counsel confirms every one.
What should a data breach holding statement include?
What happened in confirmed terms, what the company is doing, what affected people should do now, and when the next update arrives. It should leave out the cause, the attacker and any record count until security confirms them.
How much does a data breach cost on average?
IBM's 2026 Cost of a Data Breach Report puts the global average at $4.99 million, based on 602 organizations studied between March 2025 and February 2026.
Who should approve breach communications?
The response team approves them, with legal counsel reviewing every notice before release.
Where should a company publish breach updates?
On a dated incident page on the company's own domain, linked from the home page and the customer support script, with a time stamp on every update.
Conclusion
Breach communications come down to one decision made early: who makes the materiality call, and what confirmed language is ready when that call is made. Companies that want a tested 24-hour plan before an incident can work with 5W on the holding statement, the incident page and the approval path.
