Skip to main content

Crisis Communication for UK News Publishers: Cyber-Attacks, Errors & IPSO Corrections

How UK newsrooms handle publication-side crises — from cyber-attacks and leaked materials to factual errors, IPSO Clause 1(ii) correction requirements, and social-media response strategy.

Last reviewed: Next review due:

What publication-side crises look like

Most journalism training focuses on crises journalists cover. Far less attention is given to crises that happen to the publication itself. Publication-side crises include: factual errors in published stories (ranging from a misquote to a story based on fabricated information), cyber-attacks against the publication's systems, the unauthorised publication of leaked internal materials, data breaches affecting subscriber information, and reputational crises arising from staff conduct.

UK news publishers operate within a regulatory framework that creates specific obligations when things go wrong. IPSO Clause 1(ii) sets out the corrections standard for regulated publishers. UK GDPR and the ICO impose a 72-hour reporting deadline for personal data breaches. The CIPR (Chartered Institute of Public Relations) crisis communications guidance provides a framework applicable to organisations including news publishers.

The characteristic of a crisis is that normal decision-making processes are insufficient. Pre-prepared crisis protocols — tested before a crisis occurs — are essential for an effective response.

Crisis types and initial response priorities

Factual error in a published story

Immediate priority: correct the article with a clearly dated correction note. Assess IPSO Clause 1(ii) due prominence obligations. Update or address social posts that spread the original error. Notify anyone named in the error if appropriate.

Cyber-attack on publication systems

Immediate priority: isolate, contain, and assess. Activate IT incident response. Notify legal and senior management. Assess personal data breach obligations under UK GDPR (72-hour ICO notification if applicable). Issue a staff briefing via out-of-band communications.

Leaked internal materials

Immediate priority: assess scope and legal position. Issue a hold-state public statement. Seek legal advice on whether materials were unlawfully obtained. Do not speculate about origin or scope in initial statements.

Staff conduct crisis

Immediate priority: separate HR response from public communications. Issue a statement that acknowledges the situation without pre-empting investigation outcomes. NUJ representation rights apply for members.

Regulatory ruling (IPSO/IMPRESS)

If a ruling against the publication is upheld, the correction or adjudication must be published with the prominence specified by the regulator. Failure to comply creates a secondary crisis.

Social media pile-on

Distinguish between organised harassment campaigns and legitimate public criticism. Legitimate criticism requires response. Harassment requires staff protection and platform reporting. Do not delete posts that document the harassment.

Red flags to watch for

  • No pre-prepared crisis protocol — improvised crisis responses are slower, less consistent, and more likely to make things worse.
  • Issuing a public statement before internal facts are confirmed — statements that are later contradicted compound the original crisis.
  • Issuing corrections that lack the prominence required by IPSO Clause 1(ii) — insufficient prominence is itself a regulatory breach.
  • Failing to brief staff before a public statement is released — staff discovering a crisis publicly rather than internally creates a secondary internal communications problem.
  • Deleting social posts that documented an error rather than correcting them — deletion looks evasive and may not remove the content from third-party archives.
  • Not having a secure out-of-band communications channel for crisis scenarios — if primary email or Slack is compromised, you need an alternative.

Correction protocol: IPSO Clause 1(ii) in practice

  • Correct the original article: add a clearly labelled, dated correction note at the top of the article, not at the bottom where it will be missed.
  • State what was wrong and what is correct: a correction that only says the article has been updated, without explaining the nature of the error, does not meet IPSO standards.
  • Assess due prominence: the correction must have prominence equivalent to the original error. A front-page story requires a front-page correction or equivalent online prominence.
  • Address social media: update or add a follow-up to any publication social posts that shared the original article, linking to the correction.
  • Notify the subject: if the error affected a named individual or organisation, notify them of the correction as a matter of courtesy and to avoid a complaint.
  • Document the correction process: record what was wrong, when it was corrected, and what prominence was given. This documentation is essential if a formal IPSO complaint is subsequently made.

Social media crisis response strategy

Social media accelerates the spread of both crises and corrections. When a publication-side crisis becomes visible on social media, the response must be coordinated across the web article, the publication's own social accounts, and if appropriate, the social accounts of individual journalists involved.

The CIPR crisis communications framework recommends a hold-state statement for crises where full facts are not yet known: acknowledge that something has occurred, state that the publication is investigating, commit to providing more information by a specified time, and name a single point of contact for media enquiries. Silence is rarely an effective strategy — it is filled by speculation from others.

See also our Ethics & Standards guide for IPSO and IMPRESS regulatory context, and our community engagement guide for managing reader reaction during a crisis.

Common mistakes

  • Treating every online criticism as a crisis requiring a public response — not all negative coverage requires a statement; escalation should be proportionate.
  • Issuing a public apology before the internal investigation is complete — premature apologies may conflict with legal advice or contradict subsequent findings.
  • Sending a single spokesperson into a high-volume social media crisis without support — crisis communications requires a team, not an individual.
  • Not testing the crisis protocol before a crisis occurs — tabletop exercises that rehearse different scenario types dramatically improve real crisis response.
  • Using the same social media accounts for crisis communications as for normal editorial output — dedicated crisis accounts or protocols prevent mixed messaging.
  • Assuming a cyber-attack is not a UK GDPR issue — any breach involving subscriber or staff personal data triggers ICO notification obligations within 72 hours of discovery.

Related guides

Primary sources

Frequently asked questions

What does IPSO Clause 1(ii) require when a news publisher makes a significant factual error?
IPSO Clause 1(ii) requires that significant inaccuracies in published articles be corrected promptly and with due prominence. Due prominence means the correction must appear in a location and format that gives it equivalent visibility to the original inaccuracy. If the original error appeared as a front-page headline, a correction buried at the bottom of an inside page would not meet the due prominence test. IPSO has adjudicated many cases on the meaning of due prominence, and its published rulings are the definitive guide for UK publishers.
How should a UK news publisher respond internally when a cyber-attack occurs?
Immediate internal steps should follow a pre-prepared incident response plan: isolate affected systems, notify the IT security team and senior editors, assess whether personal data has been breached (triggering a 72-hour reporting obligation to the ICO under UK GDPR), and activate the crisis communications chain. Staff should be briefed on what they can and cannot say externally before any public statement is made. Communications during a cyber-attack should be coordinated through a secure out-of-band channel, as primary email systems may be compromised.
What is the correct process for issuing a correction on social media?
When a factual error in an article has been shared via social media, the correction should be posted from the same account(s) that shared the original, with a clear reference to the original post and a plain statement of what was wrong and what is correct. The original post should be edited or deleted as appropriate, with an explanation. Simply posting a correction to a website without updating or addressing the social posts that amplified the error is insufficient under IPSO's due prominence standard when the publication's own social accounts were involved in the original spread.
How should UK publishers handle a crisis involving leaked internal materials?
Leaked internal materials — internal emails, editorial plans, unpublished drafts, subscriber data — can create simultaneous legal, reputational, and operational crises. The immediate priority is to contain the leak and understand its scope. Legal advice should be sought on whether the materials were obtained in breach of confidence or through unlawful means. A public statement should be made promptly that acknowledges the situation factually without making claims about origin or scope that cannot yet be verified. CIPR crisis communications guidance recommends a hold-state statement: acknowledging the incident and committing to provide more information once facts are confirmed.
What is the IMPRESS Standards Code approach to corrections?
IMPRESS (the alternative press regulator for smaller UK publishers) requires members to have a clear published corrections and complaints policy and to act promptly on upheld complaints. IMPRESS Standard 3 (Accuracy) requires that significant inaccuracies are corrected promptly and with appropriate prominence. IMPRESS publishes its adjudications publicly and expects corrections to be made before an IMPRESS ruling is issued where possible, as prompt self-correction is a mitigating factor in any complaint outcome.