Do we tell customers before we know what happened?

Yes, if a deadline or a live risk to them says so; otherwise, not until you can say something true and useful. Those are two different groups. Customers whose contracts give them 48 hours' notice, regulators with a clock, and anyone who can protect themselves today by acting (changing a password, watching an account) should hear from you on time, with a clear statement of what you know, what you don't, and when you'll update them. Everyone else should hear from you once, accurately, rather than three times with corrections. The mistake isn't speaking early or late; it's speaking with more confidence than the evidence supports.

Separate the audiences before you draft a word

People who must be told on a clock. Contracted customers, regulators, your insurer, sometimes law enforcement. The deadline decides the timing; your job is to meet it with an honest statement. The SEC's rule for public companies, as one example, accepts that the initial disclosure may not have all the details, and provides for amending it as information becomes available (U.S. Securities and Exchange Commission, 2023). Staged, dated updates are normal.

People who can act now. If credentials were taken, the person can reset them today. If payment data was taken, they can watch their statements. The FTC's guidance for businesses is clear that notification shouldn't be delayed once you know who's affected, precisely because people can reduce their own harm (Federal Trade Commission, 2021). Delaying that message to polish it costs them.

Everyone else. The general customer base, the public, the press. Here, early and wrong is worse than slightly later and right. A statement that says "no customer data was affected," retracted a week later, is remembered far longer than a statement two days later that was accurate the first time.

What an early notice can honestly say

You don't need the whole story to say something useful. A credible early notice says: what kind of event occurred, in plain words; when you discovered it; what you've done so far; what you know about the data or systems involved; what you don't yet know; what the recipient can do; when and how you'll update them; and who to contact. It doesn't say the attacker's identity, the root cause, or the number affected unless you're sure. "We're investigating" is acceptable. "We believe no data was taken" is a bet you lose publicly if you're wrong.

The FTC's model notification letter for individuals follows this shape: what happened, what information was involved, what you're doing, what they can do, and how to reach you (Federal Trade Commission, 2021). It's a good skeleton for the business audience too.

The legal reason to be careful, and the legal reason not to be

Counsel will worry that an early statement becomes an admission. That's a fair concern and it's why counsel should see every external statement. But the opposite risk is also legal: contractual deadlines missed, regulatory clocks blown, and in the worst case a finding that you knew people were exposed and let them stay that way. Privilege protects the investigation; it doesn't protect you from a notification duty. The way through is a statement that's accurate about uncertainty. "We have not yet determined whether X" is both true and defensible.

Who signs off, and how fast

One person owns external communications during an incident, with legal review built into the process rather than bolted on. That person needs the incident lead's facts, counsel's review, and the executive owner's approval, in a loop that completes in hours. If your approval chain takes two days, you'll miss contractual deadlines and you'll be reacting to the press rather than informing your customers. NIST treats communications planning, including who may speak and to whom, as part of preparation rather than something to improvise (Nelson et al., 2025). Decide the chain now and rehearse it; it's one of the things a tabletop exercise should test (see Your Incident Response Tabletop Should Make People Uncomfortable).

The internal audience you'll forget

Your own staff will hear about it before customers do, and they'll be asked about it by customers. Give them a short, approved holding line and a place to send questions, before the external statement goes out. Otherwise the message your customers actually receive is whatever a nervous account manager improvised.

What I'd do next

Draft your early-notice template now, with the eight elements above, and have counsel approve the template rather than the first live draft at midnight. Then list your contracts with notification clauses and their deadlines. If you'd like help building the communications side of your response plan, or testing it under pressure, request a briefing. The notification clocks themselves are in Who do we have to notify after a breach, and by when?.