Chowbus, this time you did it wrong
About ten days ago, there was an email sent from Chowsbus to its customers. However, the content was linked to almost 800.000 users' privacy, which included their names, phone numbers, and addresses. The information about Chowbus’ cooperated restaurants was included too.
For any of you who don't know what Chowbus does, it is one of the most popular Chinese food delivery apps in the international community or, to a large extent, the Chinese community. Many people around me use Chowbus when they miss the taste of our homeland.
I searched for this crisis on the Internet and found that some people have found the information about themselves and those of their roommates. This whole crisis is a disaster because in today’s media landscape bad news travels so fast. The payment methods and order history might get leaked out at the same time too.
Until now, you might think this crisis is not related to PR at all, but what I want to discuss is how Chowbus handled this after a bad reputation overwhelmed them on social media. After days of quiet, everyone received a message from Chowbus CEO Lixin Wen. It was a message, not an apology. After carefully reading it, there was no one word such as "sorry" in the text. One scary thing for a PR practitioner like me is that there is no plan to solve or make up for their mistake. In the message, it says, "Thankfully, the data did not contain credit card information or Chowbus account passwords, and we are confident that this information is safe." Ironically, they think some privacy information is not as important as others. I'm confused that a CEO of a huge company can say words like this since the leakage of data can lead to targeted fraud and information theft. I also think the people who have the right to say that they are "thankful" are users like me, not the CEO.
Obviously, my friends and I are shocked when we saw this news all over social media that we frequently follow. Some people contacted customer service on the app, and the reply they received was the same, "please don't click the link. Sorry if it bothers you." After ten days, which is right now, there is no satisfying explanation from Chowbus. As far as I know, many of my friends have deleted the app from their phones.
If I were the PR representative of Chowbus, I would do things differently. First of all, I won't let the rumor go around the public for over three days. After I am clear about how the crisis happened, I will write an apology to the users immediately. Then, I will contact the IT people to find ways to shut down the leaked link to prevent more people from getting access to it. If the person who did this was found to be from internal staff, they would need to be punished by either apologizing or even fired. I also would want to prevent this same issue from happening again; by raising the security of our database's safety.
When an accident turns into a PR crisis, what is the right thing to do? I think the most important thing is not to get panic, keep calm. Do not find any scapegoat to get away with it; instead, we use our solutions to combat the crisis. Most businesses will face a public relations crisis at one time or another. I suggest every company has a PR crisis team and plan in place.
Any business should always have a response team on-site even there is no crisis during a peaceful time. The response team should be the first one you find to ensure the right people who speak on your company's behalf. This dream team should be made of internal staff who have inside knowledge of the company and external experts who can see that situation from a journalistic perspective.
This dream team is then divided into individuals who understand their responsibilities and know whether to take a proactive or reactive approach in their media coverage of the incident. "Whatever the strategy is, the company must relay protocol to any and all persons who could be approached to speak on their behalf," said Gault. "This means informing all employees, stakeholders, board members, etc., of who is to be speaking with [the] media and how they are to direct any inquiries. This will save the company from having to explain comments from any unofficial company representatives later." Then, we gather facts and communicate an effective response. We should agree on arranging our words for a response. We choose the most transparent way to address the situation and then tell people what we have done already or will do about it in the short future.
We should identify the people who need to know about the situation. It will probably be our clients, the public, and the media. The audience will depend on the context of the case, but we need to be quick. Sending messages or setting up a press release to known and friendly press contacts are likely to portray the story in a fair or favorable light. But media outlets are quick to pick up words once they break, so you should have prepared statements, and press releases ready to go before reporters approach you.
We are not done yet. Another important thing for us to focus on is to do a follow-up. It's a way to monitor our performance in this crisis. With both online and traditional media, we want to hear from the people and influencers to make sure that we can quickly uncover negative trends if there are any.
Lastly, we gather our team members together for one more time. Once the crisis is over, we do a review. In this review, we analyze how each person has handled the situation. We encourage every action that smooth the case and tries to stay away from activities that push the reputation oppositely so it won't happen again in the future.