The first hour of a breach is where companies invent a number so they can sound in control. That number becomes the story.
Breach first-hour English is four lines you can use before the count is stable: what happened as far as you know, what you are doing, who to believe, and when the next update arrives. These are the data breach holding lines Korea Japan desks can publish without a guess in them.
This is the language companion to our Korea–Japan personal data breach communications playbook. That piece covers September’s Korean entertainment and beauty breach cluster, notification craft, the dark site, CEO proof lines, and cross-border sequencing. This one gives you the sentences for hour one.
Street-smart APAC English: short sentences a tired operator can say out loud.
Communications craft, not legal advice. Notification duties differ by market. Counsel files what the law requires.
Why is the first hour where the count gets invented?
Because silence feels worse than a guess. It isn’t.
The parent piece lists the three questions users ask within minutes. Was I hit? What should I do tonight? Why should I trust you again? None of them is “how many?” The count is the question reporters ask. Answering it early with a soft number trades one headline for two: the breach, and the correction.
A checked number later beats a comforting number now.
What do data breach holding lines Korea Japan desks publish in hour one?
We are investigating a data incident.
We will not publish a record count until it is checked.
Customers should use only this page and [named channel] for updates.
Next update by [time, time zone].
Four lines. Each one does a job. Fact, restraint, channel, clock.
| Temptation | Kill this | Say this |
|---|---|---|
| Count | “Fewer than [a guessed number] users.” | “We will publish a count when it is checked.” |
| Blame | “A vendor failed us.” | “We are reviewing our systems and our vendors. We will name what we can verify.” |
| Comfort | “Your data is safe.” | “We do not yet know the full impact. Here is what we want you to do now: [one step].” |
| Channel | “Follow the CEO.” | “Updates live on this page. Treat other posts as unofficial.” |
| Misuse | “There is no evidence of misuse.” | “We are checking for misuse. We will tell you what we find.” |
The parent piece warns against promising “no evidence of misuse” if you cannot hold that claim for days. The last row keeps you honest.
What do staff hear in the first hour?
The same card, in every channel, before the public block goes live.
Do not estimate the count in Slack, to friends, or to reporters.
Send every inbound to [owner].
Do not reset passwords for users unless Security has issued that step.
The parent piece names the tell that you are already late: employees learn from social media before the internal brief. The staff card fixes that in one message.
What can users be asked to do?
Only steps Security has approved. Comms does not invent hygiene tips.
- Say: “Change your password on this service if we say so in the next update.”
- Kill: “Change every password you have ever used.”
- Say: “We will not call you and ask for a one-time code.”
- Kill: “Stay vigilant.”
- Say: “If you get a message about this incident that is not from [channel], do not click it.”
- Kill: “Be careful online.”
The parent piece says write for a tired user on a train. One step, in plain words, that fits on a phone screen.
How do Korean and Japanese versions stay on one fact core?
Lock the English spine first. Then translate. Then check that the facts match, not the tone.
The parent piece’s rules for cross-border breaches:
- Match Korean and Japanese versions on facts, not marketing tone.
- Timestamp every update in the time zones users actually live in.
- Separate “confirmed” from “under investigation.”
- Do not hide Japan exposure in a footnote.
A useful line for the Japanese page on day one: “This page is for users in Japan. The facts are the same as our Korean update, published at [time, JST].” If the two pages ever disagree, journalists will quote the disagreement.
When can you publish the number?
When it is checked, with the date you learned it.
We have now confirmed that [checked number] accounts were affected. We learned this on [date]. Here is what that means for you: [one step].
Then keep a changelog on the same page. The parent piece is blunt: update with changelogs, not silent edits. Every silent edit becomes a screenshot comparison.
The breach update clock matters more than the number. The parent piece sets out a 72-hour rhythm, from a holding line and URL at hour zero to a proof calendar by day three. Say the next update time in every post and hit it, even if the update is “no change yet.”
Monday field kit
- Pre-write the four-line block. Translate after the English spine locks.
- Agree the update clock and the page URL before an incident.
- Ban unofficial channels in the same card.
- Put Security on the user-action line. Comms does not invent hygiene tips.
- Pre-write the Japanese-page line so Japan-resident users are not an afterthought.
- When the count is real, publish it with the date you learned it.
FAQs
What are data breach holding lines Korea Japan teams can use?
They are four first-hour lines: what is known, what you are doing, the one official channel, and the next update time. They refuse to publish a record count until it has been checked.
Do we notify regulators in this voice?
No. Regulator notices follow counsel’s form and each market’s rules. This kit covers the public page and the staff freeze.
Should we say there is no evidence of misuse?
Only if Security will stand behind it for days. Otherwise say you are checking for misuse and will report what you find.
Should the CEO post first?
No. Publish the holding block on the official page first, then let the CEO point to it with a dated proof path. A CEO post that runs ahead of the page creates a second source of truth.
What to do this week
Write the four lines now. If your current draft contains a number, delete the number.
Neuwark Communications builds holding language, dark-site modules, and proof calendars under Crisis & Rapid Response and Strategy & Messaging. If your breach template still opens with a count, talk to us at Contact. More in Insights.
Related: Korea–Japan breach communications playbook · data breach spokesperson lines · crisis dark-site English · rapid-response slot English