A crisis firm’s leaked draft told a breached company to say data was “as safe as it has ever been”
Halden Rook, which advises companies and institutions on what to say when things go wrong, says the line was never used. The episode offers a rare look at how the London firm prepares its clients, and whom it prepares them for.
2 min read
LONDON — On Feb. 10, a newsletter read by people in the communications trade published, in full, a one-page document written by Halden Rook for a client preparing to disclose a data breach. At the top, in the space the firm calls the roof, was a single sentence: “Your data is as safe with us today as it has ever been.”
The document is a message house, the plan of an argument that crisis consultants draft before a difficult announcement. Halden Rook, founded in London in 2003 and now with about 60 staff in London and New York, has written them for clients for more than two decades.
In a note on the firm’s website on Feb. 17, Margaret Halden, its senior partner and co-founder, confirmed the document was the firm’s. She wrote that it was the third of four drafts, that it had been shared with the client’s team through a link to a folder that did not require a passphrase, and that the line was replaced before anything was published. The client’s final notice, sent in November, told current and former residents that names and addresses of 3,812 of them had been copied from one of its systems.
The line, she wrote, was true, but that was not the same as being right.
The firm says that from April every document it prepares will be held in a client extranet, with a named account for each user, and labeled with a matter codename rather than the client’s name.
Who the firm prepares for
The draft is a small window on a larger practice. Halden Rook sells what it calls narrative risk work: helping boards anticipate the stories that could be told about them, and the people most likely to tell them. A 2023 note by Owen Hallworth, who leads the firm’s monitoring team, urges directors to think about “named journalists, campaigners and researchers” and what each has published before.
Asked whether the firm keeps files on individual journalists, Halden Rook referred The Overseen to that note, which describes such preparation as drawn entirely from what those people have published. It did not say how many people its files cover, or whether any reporter at The Overseen is among them.
The Overseen is not naming the client, whose residents have already been notified.