When a ransomware attack hits, leaving your online banking down and your phones ringing off the hook, your first instinct may be not to say what is going on.
But your team answering the phone will need dialogue to tell members when they call and ask why they can’t access their account.
Unfortunately, this is a situation that trips up a lot of credit unions. It’s not because your technology failed. It’s because your communication plan has failed or doesn’t exist.
Members don’t necessarily want technical details during an outage. Instead, they want answers to three simple questions:
The longer those questions go unanswered, the faster people will create their own narrative. Once that narrative takes hold, it can become difficult to get the story back on track.
73% of consumers say they're more likely to stop doing business with a company after repeated bad experiences. While an outage may start as a technology problem, it can quickly become a trust problem if communication doesn’t exist or isn’t timely.
Members will often forgive the outage. They rarely forgive (or forget) feeling ignored.
One of the biggest mistakes organizations make during an incident is waiting until they have all the answers before communicating.
If you're not communicating, people are speculating. It’s important to understand that you don't need every answer to provide an update.
A simple message that says: "We're aware of the issue. We're investigating. We'll provide another update by 2 p.m." is infinitely better than saying nothing.
Your first communication isn't about solving the problem. It's about showing people that someone is aware of what’s happening and is working to fix it.
When Patelco Credit Union experienced a ransomware attack in 2024, members quickly became frustrated by the lack of information available early in the incident.
Patelco eventually shifted to a more proactive communication approach, publishing regular updates and creating a dedicated webpage to communicate service availability, restoration progress, and member guidance.
The moral of this story isn’t that Patelco experienced an attack. It’s that communication was a major part of the recovery.
When something like this happens, it’s important that you’re not only rebuilding your systems. You need to rebuild confidence as well.
So, if you don’t already have a communication plan for if (or when) an incident happens, take this as a sign to put one together. It helps way more than you think.
Here's another common mistake. When an outage happens, everyone looks at IT.
IT is trying to:
And now they're also expected to write member communications?
That's a recipe for delays.
During an incident, IT should be focused on fixing the problem, leadership should be focused on decisions, and marketing and communications should be focused on members.
If you don't know who owns each responsibility today, you'll discover the problem during an outage when time matters most.
If your online banking platform went down right now, where would you post your first update?
Many credit unions have communication plans that basically amount to: "We'll figure it out when something happens."
That's not a plan. A real communication plan includes:
During an incident, every minute spent debating messaging is a minute you're not reassuring members.
According to industry research, 90% of IT leaders report that outages and disruptions reduce customer trust, and unfortunately, that's not surprising.
Trust is built through consistency. When an outage happens, it breaks consistency.
The good news is that how you communicate during an incident can dramatically change the outcome.
Think about companies you've seen experience an outage. The ones you remember positively probably weren't the ones that avoided the problem. They were the ones that owned it, communicated, provided updates, and acted according to their plan.
Gather your executive team and ask one simple question:
"If online banking went down right now, what would our first public message be?"
Then set a timer. See how long it takes your team to answer.
If the room starts debating channels, approvals, wording, or ownership, you've just found a weakness that you can fix before members ever see it.
When the next incident happens, your members won't judge you by whether systems failed. They'll judge you by how you showed up when they did.