
MGM Resorts Cyberattack: How the Company Responded
How MGM Resorts handled the 2023 cyberattack: the 24 days from first notice to a $100 million estimate, the ransom question it left to press reports, and what crisis teams can learn.
Crisis PR guides, firm rankings, cost data, playbooks and case studies from Everything-PR.
Crisis PR is the practice of protecting and restoring an organization's reputation during a public emergency, such as a product recall, data breach, executive scandal or regulatory action. It runs in three phases: preparation, response and recovery. This hub collects Everything-PR's guides, firm rankings, cost data, playbooks and case studies on crisis PR.


How MGM Resorts handled the 2023 cyberattack: the 24 days from first notice to a $100 million estimate, the ransom question it left to press reports, and what crisis teams can learn.






A layoff announcement should lead with the people leaving. See what the Airtable post shows about order and tone, with a five-step checklist for comms teams.

Franchise crisis recovery runs on three clocks. Domino's franchise stores grew sales 14.2% in Q1 2010 after a 2009 video crisis. See what Subway did next.

Court filings accuse crisis publicist Melissa Nathan of hiding her link to anonymous attack sites. Nathan denies it. What is alleged, what is unproven, and five checks for PR firms.

Millie Moon diaper lawsuit alleges leaks and skin reactions. See what the filing says, how Zuru responded and what parents expect from a premium baby brand.

Nissan recall of 539,864 vehicles in March 2010 covered brake pedal pins and fuel gauges. See the numbers, the wording used and the communications lessons.

Page Six reports Dianna Russini hired crisis publicist Melissa Nathan before a media comeback. The sequence, what The Athletic found, and the risks of the hire.

Kahf deleted a football meme and apologized after Malaysians called for a boycott. See the timeline, celebrity reactions and what regional brands should do.

GIVA withdrew its Kriti Sanon Raksha Bandhan ad on Aug. 26, 2026. Six weeks later Sanon was still answering for it. A timeline, what the statement left out, and what brands and talent should agree first.

True Food Kitchen filed Chapter 11 on Oct. 4, 2026, closing 12 restaurants and keeping 34 open. The facts, the company's explanation, its statement on Oprah Winfrey's role, and what brands should prepare before a filing.
Start with the full reference: Crisis PR and crisis communications: the complete guide covers definitions, preparation, response and recovery frameworks in depth.
Crisis PR is the communications discipline that protects an organization's reputation while a public emergency is unfolding and rebuilds trust afterward. The work moves through three phases:
Crisis PR and crisis communications describe the same discipline, and this site uses both terms. For a step-by-step version, see the 10 steps of crisis communication.
Crisis PR covers any public event that threatens an organization's reputation, and the right response depends on the type of crisis. The table below groups the most common types and points to an EPR example of each.
| Crisis type | What usually triggers it | First audience to inform | EPR example |
|---|---|---|---|
| Product safety or recall | A defect, contamination or injury report | Regulators, retailers and affected customers | The Tylenol crisis of 1982 |
| Social media backlash | A viral post, video or customer complaint | The social team, then customers and the press | Justine Sacco |
| Advertising backlash | A campaign read as tone-deaf or offensive | Brand leadership, the agency and retail partners | Pepsi Kendall Jenner ad |
| Misinformation or hoax | A false claim about a product or company | Customers and the press | Wendy's chili finger hoax |
| Operational failure | An accident, outage or environmental incident | Employees, regulators and affected communities | BP oil spill PR disaster |
| Brand scandal | Executive conduct or a marketing decision that backfires | Employees, partners and the press | Marketing scandals 2024 to 2026 |
| Data breach | Unauthorized access to customer or company data | Regulators and the people affected | Cybersecurity crisis communications plan |
Most real crises combine two or more of these types, so a plan should cover the first audience for each one.
A crisis response moves through four time windows, and each window has one main job. The table gives a general sequence that teams adjust to the situation and the advice of legal counsel.
| Window | Main job | Typical actions |
|---|---|---|
| First hour | Confirm the facts and assemble the team | Verify what happened, convene the crisis team, pull the approved holding statement, assign one owner for approvals |
| First day | Make the first public statement | Publish a statement, brief employees and key partners, notify regulators where required, monitor coverage and social channels |
| First week | Keep the record current | Post updates at the promised times, announce corrective action, answer press questions consistently, brief staff before the public |
| First month and after | Follow through | Report progress on the fixes, correct inaccurate coverage, review what the team would change in the plan |
Some sectors, such as data security and food safety, carry legal notification deadlines that counsel must confirm at the start of a response.
A team monitors a crisis by watching the places where the story is likely to spread and setting a clear threshold for escalation. Five sources cover most situations:
The team should agree in advance what volume or type of mention moves an issue from monitoring to active response, so that escalation does not depend on one person's judgment at midnight.
A crisis team should include a decision maker, a communications lead, legal counsel and an operations lead, with other functions added according to the type of crisis. A workable core team looks like this:
Every role needs a named backup, because crises rarely happen during working hours.
A crisis communications plan contains the decisions a team should not have to make for the first time during an emergency. A complete plan usually includes ten components:
How to build a crisis communications plan walks through each component.
A crisis statement should say what is known, what the organization is doing and when the next update will come. Five elements make a first statement usable:
Legal counsel should review the statement, but the language should stay free of jargon and speculation. The planning side of this work is covered in how to build a crisis communications plan.
A brand handling a product recall should tell customers what to stop doing, what to do next and where to get help, in that order. The sequence usually runs through regulators, retailers and customers:
For worked examples, see the Tylenol crisis of 1982 and five brands that beat the crisis.
In the first hour of a social media backlash, the priority is to confirm the facts, pause scheduled posts and give one person ownership of the response. A short checklist keeps the team moving:
EPR's Pepsi Kendall Jenner ad case study shows what a tone-deaf campaign costs a brand, and Wendy's chili finger hoax shows a brand answering a viral claim. For a longer backlash, read the Converse ad backlash response.
Consumer brands plan for a crisis by listing the specific events most likely to hit them and writing approved responses before any of them happen. Four scenarios cover most consumer brands: a product safety issue or recall, a viral customer complaint, an influencer or ambassador controversy and an advertising backlash.
For each scenario, the plan names the decision maker, the approved holding statement, the retailer and platform contacts and the spokesperson. Consumer PR teams usually own this plan alongside legal and customer service, as described in what consumer PR is and how it works. See also corporate apology campaigns that worked.
Employees should hear about a crisis from the organization before they read about it in the news, or at the same time. A short employee protocol covers four points:
Employees are also the largest group of informal spokespeople an organization has, which is why internal communications belongs in every crisis plan.
A crisis spokesperson should be chosen and trained before a crisis, and should rehearse answers to the hardest questions out loud. Preparation usually covers five steps:
The discipline is covered in more detail in media training, and the first-hour checklist above applies to the spokesperson as much as to the team.
A crisis plan is tested with a tabletop exercise, a timed rehearsal in which the team works through a realistic scenario. A basic exercise runs in five steps:
The planning steps that feed the exercise are in how to build a crisis communications plan, and the longer operating reference is the 2026 operator's manual.
Crisis PR responds to a specific emergency, while reputation management is the continuing work of shaping how an organization is seen, and litigation PR supports an organization during a legal case. The three overlap, and a serious crisis often draws on all of them.
Reputation management supplies the standing record, such as coverage, reviews and search results, that a crisis tests. EPR covers it at reputation management. Litigation PR coordinates public statements with legal strategy, as defined in the litigation PR glossary entry.
Crises usually get worse because of avoidable response errors, not only because of the original event. Six mistakes recur across the cases EPR has documented:
Five patterns in failed crisis communications shows how these errors repeat across industries.
Recovery starts when the immediate threat ends and lasts until the public record reflects what the organization did to fix the problem. Five actions drive recovery:
The recovery side is covered in from crisis response to reputation repair.
Crisis PR changes by industry because the audiences, regulators and legal duties change. The table lists what sets each sector apart and where to start on EPR.
| Industry | What makes the crisis different | Start with |
|---|---|---|
| Healthcare | Patient safety and privacy obligations | Healthcare crisis communications plan and the healthcare hub |
| Cybersecurity | Legal notification timelines and an active adversary | Cybersecurity crisis communications plan and the cybersecurity hub |
| Financial services | Investors and regulators are primary audiences | Fintech and financial services hub |
| Retail and consumer brands | Product safety and viral customer incidents | Retail and ecommerce hub and consumer PR |
| Hospitality and travel | Guest safety incidents and fast-moving reviews | Hospitality crisis communications plan and the travel hub |
| Beauty | Social media pressure and retailer reactions | Beauty crisis communications plan |
| Entertainment | Talent conduct and public figures | Entertainment and media hub |
| Defense | Government customers and security rules | Defense sector crisis communications plan |
| Universities | Students, parents and federal rules | University crisis communications plan |
| Nonprofits | Donors, the board and the mission | Nonprofit crisis communications playbook |
Employee-facing work in any sector draws on internal communications and corporate communications.
Crisis PR is typically bought as a monthly retainer for preparation and as hourly or project fees during an active response, and prices vary by firm and by situation. A preparation retainer usually covers planning, training and monitoring, while an active response adds round-the-clock support from a senior team.
EPR publishes the details in crisis PR cost: retainers and active response pricing and ranks firms in top crisis communications firms for 2026. Before signing, read how to choose a crisis PR firm and when you actually need a crisis PR firm.
Before hiring a crisis PR firm, ask which crises in your sector it has handled, who ran them and how it works under time pressure. Six questions separate firms that have done the work from firms that describe it:
The guides below are grouped by what you need to do next.
Plan and prepare:
Product safety and operational crises:
Social media and advertising backlash:
Lessons across many crises:
Industry playbooks are listed in the industry table above.
AI answer engines now summarize a crisis for people who never read the original coverage, so the record an organization builds during a crisis shapes the answers people see later. The press cycle ends in days, while the summaries that ChatGPT, Gemini, Perplexity and Google AI Overviews give about a company can keep drawing on older coverage for much longer.
Two practical steps follow. First, publish a clear first-party account of the facts on the organization's own site, so that retrieval systems have a primary source to draw on. Second, check what the engines say about the organization during and after the crisis, and note which sources they cite so that errors can be corrected at the source.
EPR covers this in AI-era crisis communications and measures it in the Corporate Crisis Citation Share Index 2026.
Cybersecurity · Reputation management · Litigation PR · Public affairs · Investor relations · Media training · Internal communications