Historical data breaches are resurfacing at the most critical moment in the customer journey, when AI tools are asked if a company can be trusted, with new research warning that what a company says and does after a breach is now shaping its reputation for years.
A new report by Sefiani, part of Clarity Global, Cyber Breaches and Reputation Response in the AI Era, found that while consumers may not abandon a brand after a breach, AI-generated answers are increasingly dragging the incident back into purchase decisions long after it is resolved.
The research combined a nationally representative YouGov survey of 1,019 Australian adults, conducted 19-24 August 2026, with testing of how AI search tools reference historical incidents. Using its Surfacd AI visibility tool, Sefiani analysed three organisations that had experienced significant breaches - a global law firm, a global logistics company and an Australian private health insurer - across 30 prompts per organisation in ChatGPT, Google AI Mode and Google AI Overviews.
The study found breach history is largely invisible when consumers are just exploring a category, appearing in only 2.7% of AI responses at the discovery stage.
That changes sharply as intent narrows. Mentions rose to 13.1% during brand validation and jumped to 42.2% at the decision stage, when users directly interrogate trustworthiness. For one organisation, breach history appeared in 59.1% of decision-stage responses.
Crucially, AI did not frame breaches exclusively as a negative. Some responses referenced how organisations restored services, improved security or supported customers - underlining that the post-incident narrative matters as much as the incident itself."
If you stop communicating once the crisis is over, you leave AI to build the story from old media coverage," said Sefiani Managing Partner Mandy Galmes.
"Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third party commentary appeared."
The consumer survey highlights why that ongoing narrative is critical. While 31% of Australians said they would stop using an organisation after a breach and 53% said they might, actual behaviour is more forgiving. Of the 57% who had been a customer of a breached organisation, only 13% left, while 24% considered leaving but stayed and 20% did not consider leaving at all.
Measures taken to prevent another incident was ranked highest at 39%, followed by seriousness of the breach at 32%, type of information affected at 32%, transparent communications about what happened at 30%, and support offered at 29%.The impact of framing was tested directly. When an AI answer described an organisation as slow to notify customers and lacking transparency, only 28% said they would purchase from it. When the same scenario described prompt notification, clear explanations and practical support, purchase intent more than doubled to 57%. That compares to 67% for an organisation with generally good reviews and no breach mentioned.
Sefiani also tracked what sources AI cites when discussing breach history. Corporate content including websites and owned reports appeared most frequently, in 88% of responses, followed by editorial media at 61%, government and regulatory sources at 55%, and user-generated content including social media at 36%. The mix varied by sector and query type.
That dominance of owned and earned media reinforces the PR imperative: maintain an accessible, factual record of the incident and remediation on owned channels, and ensure credible editorial media has an independent account of response and lessons learned.
Co-founder and CEO of NSB Cyber, Shane Bell, said communications failures now define a bad incident: "Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre."
The report argues traditional cyber crisis best practice - timely disclosure, factual updates, customer support - remains essential but must be extended for AI persistence.
It sets out five additional considerations for communications teams: Publish a factual account of the incident and response on owned channels, outlining what happened, how customers were supported and what has changed. Engage with credible editorial media to create an independent record of remediation and lessons.
Maintain customer support beyond the immediate incident, recognising that ongoing experiences feed reviews and social content used by AI.
Share lessons with industry stakeholders and bodies to support broader cyber preparedness.
Monitor AI-generated responses over time to assess which sources and narratives are being surfaced.
For PR professionals, the takeaway is clear: post-crisis communications should no longer be judged only on the immediate news cycle. In an era where AI answers influence whether a customer trusts a brand enough to buy, the long tail of a breach is now written by what you leave online after the crisis ends.
