Crisis Statement Kit: Fernwood Candle Co.

Draft for review. Not legal advice. Have a lawyer review before publishing.

1. Quick Read

Summary: On Tuesday morning, Fernwood Candle Co. sent its spring sale email to about 1,400 customers. Because of a mistake with a new email tool, every recipient's email address was visible to everyone else in the CC field. Some customers replied-all, and a screenshot posted on Instagram is drawing angry comments. No passwords, home addresses, or payment details were included. Fernwood stopped scheduled emails within an hour, is switching back to its previous platform, and has promised an update by Friday.

⚠️ Get professional help before publishing

This situation involves the exposure of customers' personal data (email addresses). Legal, regulatory, or notification obligations may apply. These can depend on where your customers live. Please have a lawyer review the timing and wording of every piece in this kit before release, especially the apology language and anything about next steps or reporting. If you have business insurance, it may also be worth checking with your insurer. These drafts deliberately avoid admitting legal fault and avoid legal terms like "data breach."

Assumptions I made:

• All of the roughly 1,400 recipients are "affected customers." I've kept your word "about" because the exact count isn't confirmed.
• Dana writes in the first person ("I") for the full statement and as "we" for social posts.
• Instagram is the only social channel needed. The longer post is written for Instagram.
• "Next update by Friday" means this Friday. I've added a [DATE] placeholder so you can be specific.
• Staff questions go to Dana unless you name someone else.
• The 20% off code is left out of the public statement and posts. Leading with a discount in a privacy apology can read as trying to "buy off" upset customers. I'd keep it to the individual emails. An optional line is included if you'd rather mention it.
• The email tool company is not named anywhere. I've worded the cause as "a mistake with a new email tool" so it doesn't blame the vendor or any staff member.

Gaps to confirm before publishing:

• Lawyer has reviewed the apology wording. "Sorry" phrasing is empathetic, but it still needs a legal check.
• Lawyer has advised on whether you need to report or notify anyone, and on what you can safely say publicly about that review.
• Exact dates for "Tuesday" and "Friday" → [DATE OF INCIDENT], [DATE OF NEXT UPDATE].
• Customer contact method → [SUPPORT EMAIL] (and whether Instagram DMs are monitored).
• Exact number of recipients → [NUMBER OF CUSTOMERS AFFECTED], or keep "about 1,400."
• "Within an hour" of what? Of sending, or of noticing? The drafts say "within an hour" without specifying.
• Unconfirmed: whether anyone has used the list for spam. The drafts say "we are still confirming."
• Did any reply-all messages expose additional personal info, such as names, phone numbers, or signatures? If so, the "only email addresses" claim needs adjusting.
• Does the Instagram screenshot show readable email addresses? Ask your lawyer how to handle this before contacting the poster or hiding or removing comments.
• Does customer data still sit in the new email tool's account, and will it be deleted? Customers may ask.
• How and when you asked customers not to reply-all (email? Instagram?). The drafts say only that you've asked.
• When the individual apology emails will go out, and the code's terms (expiry, exclusions).
• Optional safety line: confirm whether you can truthfully say "We will never ask for your password or payment details by email." It's marked in brackets in the full statement.

Phrases I avoided: "data breach," "leak," "isolated incident," "any inconvenience," "we take this very seriously," "out of an abundance of caution."

2. Holding Statement (use within the first hours)

On Tuesday morning, our spring sale email went out with every recipient's email address visible to everyone else on the list. We're truly sorry this happened and for the worry it has caused. No passwords, home addresses, or payment details were included. We've stopped all scheduled emails and are switching back to our previous email platform, which sends each message individually. Please don't reply-all to the original email. We'll share a full update by Friday, [DATE OF NEXT UPDATE]. Questions: [SUPPORT EMAIL].

Dana Ruiz, Founder & Owner, Fernwood Candle Co.

(about 85 words)

3. Full Public Statement

To our Fernwood customers,

On Tuesday morning, [DATE OF INCIDENT], we sent our spring sale email to about 1,400 customers. Because of a mistake with a new email tool, every recipient's email address was visible in the CC field to everyone else who received it. The email showed email addresses only. No passwords, home addresses, or payment information were included.

If you received that email, I'm truly sorry this happened and for the worry it has caused. You trusted us with your email address, and I know it's upsetting to see it shared with a list of strangers.

Here's what we've done so far:

• Within an hour, we stopped all scheduled emails.
• We're switching back to our previous email platform, which sends each message individually.
• We've asked everyone on the list not to reply-all.

We are still confirming whether anyone has used the list to send unwanted emails. In the meantime, please:

• Don't reply-all to the original message. You're welcome to delete it.
• Be cautious with unexpected emails, especially ones that mention Fernwood or the spring sale, and avoid clicking links or opening attachments you weren't expecting.
• [OPTIONAL, CONFIRM BEFORE USING: We will never ask you for your password or payment details by email.]

Over the coming days, I'll be writing to each affected customer individually wit