The biggest document leak scandal since WikiLeaks, the Panama Papers claimed a major casualty a few days after their release: Iceland’s Prime Minister Sigmundur Gunnlaugsson stepped down after records revealed that he secretly offshored millions of dollars in family assets.
Meanwhile, Mossack Fonseca, the Panama-based law firm whose legal and financial records were hacked and then published worldwide, has scrambled to contain a PR crisis unraveling on an unprecedented scale. Both the data hack and the firestorm of media coverage it prompted seem to have caught the company completely off-guard.
It appears Mossack Fonseca simply did not have a proper crisis management plan in place—an inexcusable omission for a company that has been in operation for over 40 years and regularly handles billions of dollars in client assets.
While most organizations will never have to deal with media fallout of this global magnitude, there are certain lessons all companies should learn from the Panama Papers scandal:
-
Have a crisis management plan in place.
Rule #1: crises will happen. Nobody likes to think about negative scenarios and admit the vulnerabilities of their business. But thinking through potential problems and creating response plans for each is the best way a company can prepare itself to handle potential disasters. Crisis management planning, preparation and practice must be an integral part of any company’s PR strategy.
-
Develop crisis messaging for the CEO and senior executives.
Another thing that stood out in Mossack Fonseca’s crisis response was the initial comment of the firm’s director Ramon Fonseca, who referred to the data breach in a Reuters interview as a “limited” hack. With 2.6 terabytes and 11.5 million files leaked, this hack was anything but limited. In fact, this was one of the biggest data breaches in history—far bigger than both the information released by WikiLeaks and the NSA’s Edward Snowden.
Every statement made on behalf of a company in crisis must be well calibrated. Downplaying a major issue to try to give it a happy spin is almost always a losing strategy. Developing as much of your crisis messaging in advance as possible can save companies from rushed and ill-thought-out statements that could potentially expose them to even more criticism.
-
Assume that everything you put in writing could be leaked.
Data breaches have become ubiquitous in today’s globally connected information landscape. Still, research shows that most companies are underprepared to prevent or to handle data breaches once they occur. It is important for companies to have a clear understanding that no one is immune to a cyberattack, and that every document or email could potentially become public.
-
Conduct yourself as if you are constantly under the spotlight of investigative journalists.
Sooner or later, the truth comes out. Professional integrity and ethical business practices are more than just idealistic concepts. And while Mossack Fonseca may not be under fire for allegations of illegal activity, many of its clients have now been accused of illegal or unethical transactions, creating guilt by association in the minds of many. The only way companies can avoid such crises is to constantly consider how their work would look to the public should it be exposed.
-
Don’t blame the media.
From the outset, Mossack Fonseca accused the media outlets reporting on the leak of having “unauthorised access to proprietary documents and information taken from our company” and using them out of context. The firm’s head of public relations even threatened The Guardian with possible legal action for its use of the “unlawfully obtained” records. This is yet another bad PR move on the part of the law firm. When it comes to crisis management, engaging the media in a productive way is typically key to an effective response. Media coverage can be a double-edged sword, helping build corporate images or tearing down an organization’s reputation. In general, alienating and attacking the media is a never a great strategy.
The full repercussions of the Mossack Fonseca crisis will continue to play out for the foreseeable future. What we know already is that the case of the Panama Papers is a stark example of why every organization should be proactive about preparing itself in advance for various types of crises, regardless of the company’s size or the number of skeletons hidden in its corporate closet.
Evan Nierman is founder of Red Banyan Group, a crisis communications and public relations firm with offices in Washington, D.C. and Florida.