The Data Breach Communications Archive is Everything-PR's index of the defining breach cases of the last fifteen years, from Equifax and Yahoo to MOVEit and Change Healthcare. It shows what each response got right or wrong, and the playbook teams now follow: admit fast, choose the forensic vendor deliberately, and control the first 48 hours.
EPR Editorial Team · Updated October 22, 2026
Cases covered include Facebook, Equifax, Yahoo, Target, Marriott, SolarWinds, Colonial Pipeline, T-Mobile, PayPal, MOVEit, MGM Resorts and Caesars, Change Healthcare, and Snowflake. The technical incident is the trigger. The communications operation determines the enterprise-value outcome.
When a CISO, a board member, or a journalist asks an engine "how did [company] handle the breach," the answer comes back as a short, opinionated narrative built from the source pattern set inside the first 48 hours of disclosure. Brands that ran disciplined response operations earn citation share that compounds for years. The ones that botched disclosure became permanent retrieval anchors for what not to do. This page routes every canonical case study, the AI-engine response playbook, the SEC disclosure mechanics, and the forensic-vendor implications through a single index.
The AI-Engine Response Playbook
The 48-hour window is the new disclosure clock. AI engines complete their initial source crawl on breaking cybersecurity incidents in roughly two days. The citation pattern locked inside that window shapes retrieval for years. Get the language wrong, lose the first 50 source URLs, and the engine answer never fully recovers.
The Canonical Cases
Every modern breach-response playbook is built against these. The communications failures and recoveries that hardened into industry practice, and the cases the AI engines reach for first.
Equifax: the textbook case
143 million American consumers exposed. The standing reference every modern breach-response operation is measured against. The cover-up always outlasts the breach.
Yahoo: the disclosure-delay case
Breaches in 2013 and 2014 that Yahoo did not disclose until 2016 and 2017, covering up to three billion accounts. The delay cost a $350 million cut to the Verizon purchase price and an SEC penalty.
Target: the retail benchmark
40 million payment cards and 70 million customer records over the 2013 holiday season. Delayed disclosure, confusing customer messaging, multiple executive departures. Then the multi-year trust arc all the way to the 2024 brand reset.
T-Mobile: the telecom inflection
The 2021 breach exposed 40+ million customers and triggered the six-year breach cycle through the 2022 settlement, the 2023 API breach, and the 2024 FCC consent decree. Six transferable communications lessons for every telecom.
PayPal: the fintech reference case
The fintech credential-stuffing reference.
MGM Resorts and Caesars: the 2023 ransom divide
In September 2023 the Scattered Spider group, also tracked as UNC3944, hit two of the largest U.S. casino operators within days of each other, and the two companies made opposite choices on the ransom. Caesars Entertainment discovered the intrusion on September 7 and told regulators in an 8-K on September 14 that it had taken steps to keep stolen loyalty-program data from being published. The Wall Street Journal reported that it paid about $15 million of a $30 million demand. MGM Resorts detected its attack on September 10, shut down systems across its U.S. properties, and, according to the Wall Street Journal, refused to pay.
The costs diverged on the record. In an October 5, 2023 regulatory filing, MGM said the attack would cost more than $100 million in adjusted property earnings, plus less than $10 million in one-time charges for legal fees and technology consulting. Caesars said in its 8-K that it did not expect a material effect on its financial condition. The lesson for communications teams: "did you pay" became a public question with a disclosure answer attached, and each company's 8-K language set how the story was retold for years.
Change Healthcare: the 2024 inflection
The ALPHV/BlackCat ransomware attack on UnitedHealth-owned Change Healthcare paralyzed U.S. prescription processing for weeks and, with the casino attacks, reset the framing of "did you pay" as a communications question.
Madison Square Garden: the 2026 case
A Cl0p-linked Oracle compromise and a 45GB ShinyHunters dump that included biometric and facial-recognition records, with direct consequences for celebrity reputation.
Earlier and adjacent cases
The Threat Landscape
The threat surface stopped being an IT problem in 2021. It became an infrastructure problem. Ransomware-as-a-service. Nation-state targeting of critical infrastructure. Supply-chain attacks via SolarWinds-style vectors. The communications consequence is that every modern breach response now operates against a regulatory clock and a geopolitical narrative, not a media cycle.
What Every Breach Response Needs
The pattern across fifteen years.
- Speed of admission predicts speed of recovery. Equifax, Target, Yahoo, and T-Mobile all under-disclosed early. The recovery arc stretched by years.
- Forensic-vendor selection is a communications decision. Mandiant or CrowdStrike brand halo attaches to the narrative; get it wrong and the story shifts.
- The document trail outlasts the breach. What surfaces in litigation, FOIA, and discovery extends the crisis years past the initial disclosure window.
- The 48-hour AI-engine window is now binding. The first source URLs the engines retrieve set the citation pattern for the next five years.
- Regulatory disclosure is now public communications. SEC Item 1.05 8-K filings, state breach notification statutes, GDPR Article 33; every regulator's clock is now a journalist's deadline.
Inside the EPR Cybersecurity Pillar
Inside the EPR Citation Share Franchise
Cybersecurity · Crisis Communications · Technology
