Cyber crisis communications is the discipline of managing an organisation's external and internal communications during and after a cyber incident — including data breaches, ransomware attacks, and critical infrastructure disruptions. It requires a specialist because the conditions of a cyber incident are unlike any other crisis: digital communication infrastructure may be completely offline, regulatory disclosure timelines are compressed, and media and legal exposure compound simultaneously. Generic crisis PR experience is insufficient. Effective cyber crisis communications requires practitioners who understand cybersecurity threat categories, regulatory notification requirements, and how to operate when email, VoIP, and internet access are unavailable.

This practice combines the regional technology sector authority of Pinpoint PR — with deep relationships across cybersecurity media, regulators, and enterprise stakeholders across Southeast Asia — with the crisis communications and media training pedigree of Mediacraft Communications, led by Brian Shrowder, an industry veteran with decades of broadcast journalism and high-pressure executive crisis coaching experience. Together the practice covers pre-incident planning, live incident response, and post-incident reputation recovery across Asia Pacific.

Pre-incident planning centres on the development of a Response Strategy and Policy Handbook — a physical playbook produced before any incident occurs. It details stakeholder matrices, alternative communication channels for use when digital infrastructure is offline, approved holding statements, escalation protocols, and clear roles for senior executives. The handbook is built around your specific organisational risk profile and is designed to be actionable under pressure, without requiring internet access or digital systems to use.

Two formats are available. The Full-Day Masterclass equips external communications teams with public messaging and media relations tactics for use during a live breach — including spokesperson preparation, holding statement frameworks, and media handling under extreme time pressure. The Half-Day Audit is a deep-dive session to map sensitive data categories and build targeted message trees for key stakeholder groups, including regulators, customers, investors, and employees. Both formats use interactive, high-stakes simulations tailored to the organisation's risk profile.

Contact us immediately via the confidential briefing form or directly by phone. Active incident response is one of the four service categories we offer, and our regional team can mobilise rapidly. We provide on-the-ground advisory to manage intense media scrutiny, liaise with regulatory bodies, and steer your executive team through the fallout. You do not need to have engaged us before the incident — though organisations that have completed pre-incident planning with us are significantly better positioned when an incident occurs.

The practice is designed for organisations operating under the regulatory frameworks most relevant to Asia Pacific enterprise operations — including Singapore's Personal Data Protection Act (PDPA) and MAS Technology Risk Management Guidelines, Indonesia's Personal Data Protection Law, the Philippines Data Privacy Act, and Australia's Notifiable Data Breaches scheme. We help organisations understand their disclosure obligations, manage the timing of regulatory notifications, and align public communications with legal requirements across multiple jurisdictions simultaneously.

Pricing depends on the service category. Pre-incident planning and handbook development, and workshop and training formats, are priced on a project basis following an initial confidential briefing. Active incident response is available on a project or retainer basis. Retained advisory — ongoing on-call access to senior counsel — is priced as a monthly retainer. All engagements begin with a confidential consultation; there is no obligation at that stage.

Yes. All enquiries, consultations, and engagements are treated as strictly confidential. The intake form on this page is a private consultation request. We do not disclose client relationships in this practice area without explicit permission, and we do not reference active or past cyber incident engagements publicly.