Crisis – what now?

Crisis communication: Why preparation is key to building trust

How companies should organise themselves to remain capable of acting in an emergency, and why trust-building PR work makes all the difference.

According to the Bitkom study ‘Economic Security 2025’, the total losses incurred by companies affected ‘only’ by theft, sabotage and industrial espionage amounted to around 289.2 billion euros in 2025, with 87 per cent of German companies affected. By way of comparison, in 2024 the figure stood at around 267 billion euros. The threat situation is therefore continuing to worsen. Small and medium-sized enterprises are particularly at risk here, as phishing or ransomware attacks can have consequences that threaten their very existence.

A cyberattack, a data breach, a product fault or misconduct within the company. Emergencies usually strike organisations precisely when they are least prepared for them. What is said – or not said – in the first few hours often shapes public perception for years to come. This is precisely why crisis communication is not something to be left until an emergency arises. It begins long beforehand, during the preparation phase, and affects many areas of the business. Here at Kafka Kommunikation, we have already supported a number of companies through crises that threatened their very existence, assisting them both in terms of communication and organisation.

Why good preparation is crucial

In the heat of a crisis, every minute counts. Nevertheless, the most important thing is to keep a cool head. Hasty reactions, press releases cobbled together in a rush, or hastily arranged press conferences are not advisable. Ideally, in the event of a crisis, everyone should already know what to do. This is because stakeholders – such as journalists, customers, investors and the company’s own workforce – now expect answers almost in real time, fuelled by social media, where information (but also misinformation!) spreads within minutes. Companies that only start to clarify responsibilities or agree on wording once a crisis has already begun lose valuable time. It is precisely this delay that is often interpreted as uncertainty or a cover-up, even when that is not the case.

Good preparation gives companies what is in shortest supply during a crisis: time and the ability to act. Those who know in advance who makes the decisions and who speaks on behalf of the company can focus on what matters most during the acute phase – namely, the issue itself and the people affected by its consequences.

What should be prepared and kept ‘in the drawer’?

• Crisis communication plan: A documented procedure outlining typical crisis scenarios, responsibilities, approval processes and prepared key messages – not a rigid script, but a reliable framework.
• Crisis management team with clear roles: A pre-appointed and prepared interdisciplinary team (management, communications, legal, HR, and, where applicable, IT/security) with defined responsibilities and arrangements for cover – including for nights, weekends and public holidays.
• Designated and trained spokespersons: Clear guidelines on who speaks to the outside world, including media training for emergencies. Unrehearsed, spontaneous statements are one of the greatest risks in crisis situations.
• Up-to-date contact and escalation lists: Contact persons available 24/7 – both internally and externally (press, authorities, partners, law firms) – regularly updated, not just sought out when a crisis strikes. Weekends should also be covered, as crises do not take weekends off!
• Prepared statement templates and a “dark site”: Pre-formulated text modules for likely scenarios, as well as a prepared but as yet unpublished crisis website, significantly reduce response times.
• Monitoring to ‘feed’ the early warning system: Continuous social media and media monitoring, coupled with effective ‘issues management’, to identify crisis-prone topics at an early stage before they escalate into a crisis.
• Streamlined but binding approval processes: Clearly defined roles for who is authorised to, for example, approve press releases during a crisis – without lengthy coordination loops across multiple hierarchical levels.
• Regular crisis simulations: Running through crisis scenarios in advance (table-top exercises) to identify weaknesses in the process before they become apparent in a real crisis. This gives companies enough time to adapt and optimise their processes.

Yes, all this takes effort and time. Crisis preparedness is not a favourite topic in companies; nobody wants to experience a crisis, and the risk of one is often ‘ignored’.

When a crisis strikes – what should be done?

In an emergency, speed takes precedence over perfection. An initial, honest update is more valuable than days of silence whilst waiting for the perfect wording. Consistency across all channels is equally crucial. The website, customer communications, social media, the press and internal communications must all convey the same message, as contradictions immediately undermine credibility. Employees should always be informed first. Anyone who learns of their own company’s crisis from the media loses trust in the leadership. Internal communication must always be one step ahead of external communication.

It is just as important to take responsibility rather than gloss over the issues. Empathy and a willingness to admit mistakes come across as more credible than defensive rhetoric or downplaying the situation. Added to this is communication that is tailored to the target audience and nuanced, as the press, customers, staff and investors have different information needs – true to the motto: one message, many appropriate formats. And finally, the follow-up should not be forgotten, because ‘after the crisis is before the crisis’. A structured debriefing highlights what worked and where the crisis plan still has gaps.

Real-world examples

Kafka Kommunikation has supported a number of companies through crises. We are not at liberty to name them here, but they were companies from the software and IT sectors as well as the B2C sector. In each case, these companies were paralysed and blackmailed by ransomware incidents. Our first step was to set up a crisis team within the company; we held telephone meetings with this team every 24 hours to determine the next steps for the following 24 hours.

In doing so, we took everyone into account: stakeholders such as customers, staff and the press, as well as trading partners and integrators. We drafted press releases, wrote letters to staff, prepared Q&As and closely monitored how the crisis was unfolding, thereby adapting our crisis plan to the latest developments.

Next, we brought in a company to negotiate with the blackmailers. Negotiating and paying a ransom is no guarantee that the IT infrastructure will be restored. At the same time, the IT departments were also working flat out to restore the status quo. After a month, or rather several weeks, the basic infrastructure had mostly been rebuilt and it was once again possible to dispatch goods. At another company, it took longer because the computers were no longer usable; however, there were still a few old laptops in the company’s basement. The CEO then personally drove these to the individual branches to get business operations back on track. Customers were informed of a “disruption” via an up-to-date notice on the website. Both companies managed to overcome the crisis under their own steam – and with the help of backups. However, it is difficult to determine the full extent of the damage, including the damage to their reputation.

Why dedicated and strategic PR work makes all the difference

Trust cannot be built quickly in the midst of a crisis. It must be in place beforehand. Companies that invest in genuine, credible relationships with journalists, customers and the public over the long term have credibility to draw on in an emergency – an asset that no amount of crisis planning, however good, can replace in the short term. Those who have communicated transparently and been approachable even before the crisis are more likely to be given the benefit of the doubt in difficult times. That is why it is important to work with an experienced PR agency that monitors the right issues and builds trust between the company and its stakeholders – and, above all, with journalists. Agencies such as Kafka Kommunikation, which have excellent media contacts, help to identify the right editorial teams in the event of a crisis and to get in touch with them.

Professional communication work goes beyond mere visibility to forge resilient relationships – both between companies and their target audiences, and with the media, which, in the event of a crisis, will report fairly and objectively because they already know the organisation and its contacts and can put them into context. Good PR work is therefore far more than just crisis prevention. It is the foundation of trust upon which all successful crisis communication is built.

Crisis communication begins long before the first press release is issued in an emergency, with structures and processes that, ideally, have been put in place years beforehand. And with PR work that continuously builds trust, rather than only seeking it when it is most urgently needed.