Very shortly, the CEO of a big South African corporation will call a press conference to apologise to the organisation’s customers for leaking their personal information during a hack on its IT systems.

The CEO will reassure the corporation’s clients, as well as its shareholders and suppliers, that the data security breach has been identified and fixed. Media representatives at the conference will be told that a full investigation is underway to determine how the security lapse occurred, how long it went undetected, and what data was accessed by the cyber hackers. They are likely to respond by quizzing the CEO about the identity of the hackers, the motive for the attack and the extent of the damage caused by the incursion. They will probably be told that it’s too early to answer such questions, but assured that the corporation is doing all in its power to safeguard the interests of its clients.