The first hour of a bad situation is not when you explain what happened. You usually don't know yet. It's when you decide whether the story becomes "company has a problem" or "company has a problem and is hiding it."
A holding statement is the tool for that hour. It is a short, pre-approved, factually minimal public statement that acknowledges a situation, says what you're doing, and commits to an update. It is not a defense, an apology tour, or an explanation. Done well, it costs you almost nothing and stops the vacuum from filling with speculation. Done badly, it becomes the quote that gets pulled into every follow-up article for the next two years.
Why silence loses by default
When something visible goes wrong (the app is down, a customer posts a photo, a reporter has a document), the story is already moving. Journalists, customers, and competitors will describe the situation with or without you. Absence of a statement is itself a statement, and the version that gets written is "the company did not respond to a request for comment."
The reverse mistake is worse: rushing out detail you haven't verified. Every fact you assert in hour one that turns out to be wrong in hour six becomes a second story about your credibility. Holding statements exist precisely to let you be present without being wrong.
The anatomy of a holding statement
Five parts, in this order, usually under 100 words total.
- Acknowledgement. Name the situation in plain language, at the level of detail you can actually confirm. Use "We are aware of" or "We have confirmed," whichever one is true.
- Concern for people. If anyone was harmed, inconvenienced, or put at risk, that comes before anything about the business. One sentence, specific, no adjectives doing emotional work.
- Action. What you are doing right now. Investigating, taking systems offline, contacting affected customers, cooperating with authorities.
- Commitment to update. A time window you can hit. "We will provide an update by 4pm ET" is worth more than "we will update as soon as possible," but only if you actually update at 4pm, even if the update is "still investigating."
- Contact. A named person or address for press. If you don't route journalists somewhere, they'll route around you.
What's deliberately missing: cause, blame, scope estimates, financial impact, and reassurance you can't back up.
Four worked examples
1. Service outage
We are aware that customers are unable to access [Product] as of approximately 9:15am ET this morning. Our engineering team identified the issue and is actively working to restore service. We know our customers depend on this platform to run their businesses, and we're sorry for the disruption. We will post an update on our status page every 30 minutes until service is fully restored. Press inquiries: press@company.com.
Why it works: it gives a timestamp (which journalists need), confirms only what customers can already see, and moves the ongoing narration to a status page, so your updates live somewhere structured instead of in ad hoc tweets.
2. Suspected data incident
On [date], we identified unusual activity in one of our systems. We immediately engaged an outside cybersecurity firm and began an investigation to determine what occurred and whether any customer information was involved. We have also notified law enforcement. We have not yet confirmed the scope of the incident. If we determine that customer data was affected, we will notify those customers directly and comply with all applicable notification requirements. We will provide an update by [date].
Why it works: it uses "unusual activity," not "breach," because "breach" is often a legal determination you haven't made. It commits to notification without predicting what notification will say. Note that anything in this category should be reviewed by counsel before it goes out. Data incidents carry regulatory notification clocks that vary by jurisdiction, and the wording of a first statement can matter later.
3. Executive departure
[Name] is no longer with the company, effective [date]. [Name/Title] will assume responsibility for [function] while we conduct a search. We do not comment on personnel matters. The company's operations and commitments to customers are unaffected.
Why it works: it's short on purpose. Executive exits are where companies talk themselves into trouble. An effusive "we thank [Name] for their contributions" reads as a cover-up if unflattering facts surface later, and a pointed statement invites a defamation problem. State the fact, name the continuity plan, decline the rest. "We do not comment on personnel matters" is a legitimate non-answer, and journalists accept it because it's a real policy, not a dodge invented for this occasion.
4. Product safety concern
We have received reports that [specific product, lot/model numbers] may [specific behavior]. Customer safety is our first priority, and we have stopped shipments of the affected units while we investigate. Customers who own [product identifiers] should [specific action: stop using it / contact us / return it]. Anyone who has experienced an issue can reach us at [phone/email]. We are in contact with [relevant regulator] and will update customers directly as our investigation progresses.
Why it works: the instruction to customers is the most important line in the whole statement, and it's specific enough to act on. A safety statement that doesn't tell people what to do is a legal document wearing a press release costume.
What never to say
- "No comment." It reads as guilt. If you can't discuss something, say why: "We're not able to discuss this while the investigation is ongoing."
- Speculation about cause. "We believe this was an isolated incident" in hour one is a claim you will have to defend in week three.
- Numbers you haven't verified. Customer counts, records affected, financial impact. The first number you say becomes the anchor every correction is measured against.
- Blame directed outward. Vendors, contractors, a former employee, "a small number of bad actors." Even when true, it reads as evasion and it usually invites the named party to respond publicly.
- Superlatives about yourself. "We take security extremely seriously" is the single most mocked sentence in corporate communications. Show it with the action line instead.
- Anything conditional on a lawyer's approval you haven't gotten. In any incident with legal, regulatory, or safety exposure, counsel reviews before publication. That is not a delay tactic. It is how you avoid making the situation worse.
Prepare these before you need them
The companies that handle bad hours well are not faster writers. They wrote the templates months earlier. Draft holding statements for your three or four most plausible scenarios, get them reviewed once by legal, and store them where the person on call can find them at 11pm. Pair that with a maintained press page listing who speaks for the company and how to reach them, so a journalist working a deadline has a path to you that isn't a contact form.
One more distinction worth keeping straight: a holding statement is not a press release and should not be distributed like one. It goes to the people asking: journalists, customers, your status page, and your support team. Wire distribution is for news you want amplified, not situations you want contained. If the incident later ends in a resolution worth announcing, that's when the announcement formats come back into play.
Most PR is routine, so see [how the guided builder works](/how-it-works) for the announcements you do want people to read.