INTReputation and intelligence

Online reputation crisis: what to do in the first four hours

A video, a review or an article about your company is spreading. The sequence to follow in the first hours, who to involve, which legal obligations may apply and the mistakes that turn a passing incident into a full-blown story.

Strategic editorial team 22 July 2026 8 min read

Cover: “Reputation crisis: the first four hours”, Reputation and intelligence

In the first four hours of an online reputation crisis, a company has four things to do. It must understand what is circulating and how much traction it has. It must decide who speaks and what the line is. It must publish a first statement, even a short one. And it must preserve the evidence. Four hours is not a threshold set by any law. It is a practical benchmark, the time in which a piece of content can still remain a passing incident rather than become a full-blown story.

A typical scenario. Tuesday, 11.40pm. A video showing poor service at one of the company’s shops starts circulating on a social network. The marketing manager sees it at 7am the next day, by which time three local pages have shared it and a journalist has written a few lines. The first internal meeting is at 10am and the first public response goes out at 3pm. More than fifteen hours have passed, long enough for others to tell the story in the company’s place.

Why do the first hours matter so much?

A reputation crisis is the moment when a fact, true or false, calls into question the trust that customers, employees, banks or institutions place in an organisation. Online, the damage takes shape early. Content that attracts reactions in the first hours is shown to more people, and every share adds to the audience.

Today, silence risks being read as an admission. Every hour without an official position is an hour in which users, competitors or news outlets write the version of events instead of the company. That does not mean answering immediately and badly. It means having a method that lets you come out with a consistent position within hours, not days.

The first mistake, though, comes before any response. It is not knowing that it is happening. Many companies discover their own crisis when a customer forwards it to the chief executive on WhatsApp. Automatic alerts for brand mentions, set up by the company on its own channels, on social media, on review sites and in search engines, exist precisely so that you know at 11.45pm rather than at 7am the next day. They also make sure the notification reaches whoever is on duty under the internal rules.

What should you do, hour by hour?

Here is a reference sequence, to be adapted to your organisation.

When	What to do	Who handles it
First 30 minutes	Check what really happened, where it is circulating, who is saying it and how much traction it has. Save screenshots with address, date and time	Whoever notices it, with the communications lead
Within the first hour	Bring the core team together: management, communications and legal. Add IT if there is a cyber-attack and HR if employees are involved	Management
Within the second hour	Decide the line and the spokesperson. Instruct staff internally that nobody responds from their own profiles	Communications and management
Within the fourth hour	Publish a first public statement on the channel where the discussion started: what is known, what is being checked, when the next update will come	Spokesperson
Afterwards	Track mentions, update at the time announced, assess legal action	Core team

A first statement does not have to contain everything. A sentence like this can be enough: “We have seen the video posted last night. We are checking with the shop what happened and will give an update by 2pm.” What matters is that it is true, that it comes quickly and that the update really does arrive.

Who needs to be involved besides communications?

In a reputation crisis, “who to call” means roles, not a phone number:

Legal counsel, if the content may be defamatory, if a takedown needs to be requested or if a criminal complaint is being considered. In Italy, for offences that can only be prosecuted on the victim’s complaint, the standard deadline is three months from the day the victim learns of the facts.
The insurer, to check what the policy covers and which notifications it requires.
The authorities, when the crisis brings specific obligations with it. If it involves a personal data breach, the GDPR requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours. If it stems from a serious cyber incident at a company covered by NIS2, the EU directive on network and information security, the early warning must be sent within 24 hours. In Italy it goes to CSIRT Italia, Italy’s national computer security incident response team.
The platforms, for illegal content. The Digital Services Act requires hosting services to offer a mechanism through which anyone can report it.

How can you tell if there is a coordinated attack behind it?

The right words count for little if you don’t know who is talking, where and with what intent. A dissatisfied customer is one thing. An organised campaign is another, and it calls for a different response. Some signs deserve attention:

Many recently created profiles posting almost identical sentences.
Comments concentrated within a few minutes, sometimes at unusual hours.
Negative reviews that arrive in waves, with no reference to actual experiences.
Content that draws on internal information, a sign that the crisis may hide something else, such as a dispute, a conflict between shareholders or a former employee.

To find out, you work only from open sources and public channels, within the law. That rules out fake profiles, access to closed groups and investigations into individuals. In Italy, investigations on behalf of private parties require the licence provided for by the TULPS, Italy’s consolidated public security law. Analysis tools, including AI-based ones, help read thousands of comments and group them by topic, time and origin. The assessment remains with a person.

What should you avoid?

Deleting legitimate criticism. The people who wrote it post it again, often with screenshots of the deletion.
Responding in the heat of the moment or attacking the authors of the content.
Letting several people speak, with different versions.
Communicating unverified facts, which then have to be retracted.
Buying or commissioning positive reviews. In Italy this is a commercial practice that is always considered misleading.
Promising to make a true story disappear. You can respond, clarify and give context. The removal of unlawful content is requested with legal counsel, and no one can guarantee the outcome.

And when the crisis hits a person, not just the brand?

There is a category of cases that calls for a different level of confidentiality: executives who are being targeted, personal matters that risk dragging in the company, disputes between shareholders that reach the press. Here a press release is not enough. What is needed is confidential work, with few people and written rules. For these situations there is Blackroom, Strategic’s confidential advisory for owners and boards. Access follows an assessment and is covered by a non-disclosure agreement (NDA).

How do you prepare before it happens?

The companies that come through a reputation crisis best are those that decided in advance the things there is no time to decide in the first hours:

Who belongs to the core team, with a deputy for each role.
Who the spokesperson is and who stands in for them.
Template first statements for the most likely cases.
Rules for employees on their own social media profiles.
Automatic alerts for brand mentions, set up by the company on its own channels, stating who receives them out of hours.
A periodic simulation, to find the weak points before a real crisis does.

In brief

In the first four hours you verify the facts, appoint a spokesperson, publish a short first statement and preserve the evidence.
Silence risks being read as an admission. A hasty, wrong answer does just as much damage.
Legal counsel, insurers and the authorities need to be involved early when the crisis carries legal obligations.
To find out whether there is a coordinated campaign, you use only open sources and public channels.
Roles, templates and rules decided in advance save the hours that count.

Frequently asked questions

Who should speak for the company?

It should be one person, chosen before the crisis. This is often the head of communications, and sometimes the chief executive when the issue touches trust in the company as a whole. Everyone else refers questions to the spokesperson and does not respond from their own profiles.

Should negative comments be deleted?

As a rule, no. Insults, personal data and unlawful content can be moderated under the platform’s rules, but deleting legitimate criticism fuels the discussion. It is better to answer once, with the facts, and say where updates will appear.

Can you ask for false content to be removed?

Yes, when the content is unlawful, for example defamatory. Platforms must offer a reporting mechanism under the Digital Services Act, and legal counsel assesses whether to take action elsewhere too. Before asking for removal, preserve the evidence, with address, date and time.

Do the four hours apply to a cyber-attack as well?

The logic is similar, but the rules change. A cyber incident has its own technical sequence. For organisations covered by NIS2, or hit by a personal data breach, the law also sets notification deadlines. Communication has to be coordinated with whoever is managing the incident. Our page on cybersecurity explains how to set this up.

A review of open sources at agreed intervals, a crisis plan and support through the difficult days are the work described on our page on communication and intelligence. It is a starting point for anyone who wants to be prepared. The contact form on this site is not an emergency channel.

Sources

Consulted on 16 September 2026.

Find out moreCommunication and intelligenceCommunication at sensitive moments, management of reputational crises and a clear reading of what public sources say about the company.