View from the Street: Match-fit for a cyberattack? Why reputation matters more than firewalls
Published
David Gaffney
Last week Jaguar Land Rover admitted its production and sales operations were being “severely disrupted” by a major cyberattack. A week on, the company is still grappling with the fallout.
They are far from alone. In recent months the Co-op, Harrods and Marks & Spencer have all been hit by hackers. M&S, once seen as untouchable on the high street, was forced to suspend online sales for nearly six weeks this summer after a ransomware attack, at a cost of some £300 million.
No organisation is too big or too successful to escape the pervasive threat of cybercrime. The question is not if, but when. And when it happens, the strength of your reputation will determine how well you recover.
“Trust is the foundation that allows an organisation to take responsible risk, and, if it makes mistakes, to rebound from them.”
— Edelman Trust Barometer, 2023
I was reminded of this at a conference hosted by the Cyber and Fraud Centre Scotland, a social enterprise providing accessible and affordable support to organisations across the country. I had been invited to lead a session on crisis communications. My message was simple: communications matter, but trust matters more.
Trust is earned by consistency over long periods of time. It requires organisations not only to excel at what they do, but to deliver reliably, respect their stakeholders, and engage with them honestly and empathetically.
That was the real lesson from M&S. Customers forgave the disruption because they had already come to value its products, appreciate its consistency and believe in its brand. As The Economist observed: “A few years ago an incident like this could have been fatal. M&S was to the retail industry what flip-phones are to telecoms. Its stores were crumbling and poorly located… The website was clunky.”
Today, customers trust M&S again. And that reputational shield helped the business weather the storm.
But cyber risk extends beyond the high street. The NHS has suffered repeated ransomware attacks, forcing hospitals to cancel appointments and delaying patient care. In those moments, public trust is not just about consumer convenience but about safety and the integrity of vital services. A cyberattack doesn’t only test IT systems – it tests faith in the institutions people rely on.
That’s why directors must treat cyber resilience as more than an IT problem. It belongs in the boardroom. Regulators, investors and customers all expect leadership teams to show foresight, transparency and accountability. Organisations that prepare for the worst, rehearse their response, and communicate candidly are the ones that preserve confidence when pressure hits.
But trust is not a permanent asset. To adapt Oscar Wilde: losing one set of data may be regarded as misfortune; losing more looks like carelessness. Sympathy runs thin when the same organisation fails again.
That’s why directors should not view resilience in the face of one cyberattack as proof they can withstand another. Customers will forgive once, maybe twice. But like a referee handing out cards, the third offence is unlikely to be met with indulgence.
Trust is like data: hard to earn, easy to lose, and vital to survival. Strong cyber security is essential, but reputational security is just as important. Organisations must prove they deserve trust – and then guard it as fiercely as they guard their systems.
If you’re leading an organisation today, ask yourself:
- Do we have a crisis communications plan that covers cyberattacks?
- Have we rehearsed how we would respond under pressure?
- How much “trust equity” have we built with our customers and stakeholders?
- Would they forgive us if we were hacked tomorrow?
Cyber defences can fail in seconds. Reputations are built over years. Protect both as if your survival depends on it – because it does.