@DassieSpivack: At some point in the next year, you're probably going to have to email your customers and tell them you got hacked. I'v…

At some point in the next year, you're probably going to have to email your customers and tell them you got hacked. I've watched a lot of CEOs write that email, and almost all of them wrote it in a state of panic, not thinking clearly, a few hours after finding out that they were hacked. This…isn’t ideal, as it’s the first thing anyone looks at if this situation ever turns into a lawsuit. So here's how to write a breach email properly, so you have it before you need it. First, I beg you. Write a template now and get it approved by your lawyer. That way, when your world is on fire, all you have to do is fill in the details, instead of having to write it from scratch in the heat of the moment. When a breach does happen, send the email to your customers, quickly. Most CEOs either wait for perfect information or play it down and hope customers never find out. But in my experience, customers find out just about every time, and the companies that hid it ended up far worse off than the ones that were upfront. Legally, what matters most is just telling people a breach happened. You don't need every detail to do that. In the email itself, keep it to what you actually know about what happened/what you're doing about it. The rule your lawyers will care about most is that you never publish anything you might have to take back later. That doesn't necessarily mean saying as little as possible though! You're walking a line between not retracting anything, not sounding cold, and making your customers feel like you're on their side and someone they can trust. The right phrases help a lot with that. I tell people to use ones like "out of an abundance of caution" or "purely as a precautionary measure." Obviously they sound corporate, but they let you notify people early without committing to a scope you'll have to walk back later. "As soon as we were notified, we took steps to further protect your account" shows you moved right away, and "we will continue to monitor the situation closely" tells people more updates are coming. And a lot of what CEOs instinctively want to write works against them. "There's no evidence your data was misused" and "only a small number of customers were affected" sound reassuring, but you probably don't know either one for sure yet, and if you're wrong, you'll have to retract it, which causes a whole new set of problems. "This was a highly sophisticated attack" sounds like an excuse, and it makes things really awkward if it turns out to be something simple. "We apologize for any inconvenience" treats a breach like a small annoyance, which it obviously isn't. And something like "we take your security very seriously" is in just about every breach notification email these days, so nobody believes it anymore. The key is making sure your email doesn't read like a script. Use these phrases, but write it the way a person would (it needs at least a little life!), and make it at least a little unique so people feel heard and can tell you're taking it seriously. Canned language comes across very cold, so avoid this. Make sure your support team has a party line ready, so everyone's giving the same answers and no one is contradicting anyone else. I'll put an example of a really good breach email in the replies if you want it. Save this so you have it when you need it, because with everything going on right now, you likely will. Later this week, I’ll share more of the breach response process, so follow me with notifications if you don’t want to miss it.