When something goes wrong in a business, the immediate focus is usually on fixing it. That makes sense. But while the technical team investigates, another problem can develop: the people affected are left waiting for an explanation.

OpenAI’s unauthorised access to Australia’s Medicare statistics portal offers a timely lesson in crisis communications. The incident raised questions about AI safety, but it also exposed something every business should understand: the way you report a problem can become part of the problem.

When the response becomes the story

According to the Prime Minister’s account on 24 September, an OpenAI agent accessed public and non-public files in the Medicare statistics reporting portal in June. The government was notified on 10 September through an email sent to a public mailbox.

At that stage, authorities said no personal information was believed to have been accessed. That distinction matters. A statistics portal breach should not be described as the theft of Australians’ patient records.

Even so, the Prime Minister criticised both the time taken to notify the government and the way the notification occurred. OpenAI subsequently apologised, acknowledging that it should have handled its response better.

For business leaders, the communications lesson is clear. Stakeholders will assess how an organisation behaves after an incident alongside what caused it.

Sending an email is not enough

Most businesses have processes for reporting operational issues. Someone fills in a form, sends an email or raises a ticket. That may work for routine matters.

A serious incident needs a different level of attention.

If your business discovers a problem that could affect a client, customer or partner, reaching the right person matters. So does confirming they have received the information and understand its significance.

An email can document that you made contact. It cannot, on its own, establish that the issue has reached someone who can act.

A practical crisis communications plan should identify escalation contacts, alternative channels and the person responsible for following up. Those details are easy to overlook until an urgent message sits unanswered.

Communicate what you know

One reason organisations delay communication is that they want a complete picture first. They worry about creating alarm, getting details wrong or having to revise their initial account.

Those concerns are reasonable. But waiting also has consequences.

People can understand that an investigation is continuing. They are less likely to accept discovering that an organisation knew about a serious issue and failed to tell them.

An initial response should explain what has been confirmed, what remains uncertain and what is being done. It should also give stakeholders a clear expectation of when they will hear more.

Accuracy matters more than confidence. Avoid broad assurances that the evidence does not support, and correct information promptly when new facts emerge.

An apology needs follow-through

An apology can acknowledge concern and demonstrate accountability. Its value depends on what happens next.

Customers and stakeholders want to know whether the problem has been contained, how they might be affected and what will change.

Promises to improve need specific actions behind them. Otherwise, the next incident invites an uncomfortable question: what happened to the commitments made last time?

This is where reputation management connects with operations. The communications team needs access to the people investigating and resolving the issue. It cannot explain progress it has not been told about.

Prepare before the pressure arrives

For Australian businesses, the useful question is whether your own team would know what to do.

Who decides an issue needs escalation? Who contacts affected clients? Who approves the first statement? Who speaks publicly?

A crisis communications plan gives those decisions a starting point. Testing it against a realistic scenario reveals missing contacts, unclear responsibilities and approval delays.

At Popcom, we help businesses prepare for difficult conversations and communicate clearly when the pressure is on. Preparation gives leaders the time and structure to make better decisions when trust is at stake.