Case Study: After a Crisis, Who Should Take the Fall?

The four weeks since hackers had attacked his company had been the most stressful of Jake Santini’s career. Sitting at his kitchen table after another long day of meetings and interviews, the CEO read the email from his board chair again, this time out loud to his wife, Fleura: “It’s the strong feeling of the board that someone needs to be held publicly responsible for what happened. While we’re confident that the issue has been handled, we feel this is a critical step in making amends with our customers and restoring our image in the public eye.” The board chair, Carly Elliot, had been a director at SimplePay, an Austin-based mobile-payment processor, since its days as a start-up. She and Jake had always worked well together, so he was a little taken aback that she was sending an email about something so sensitive rather than calling him. Fleura shook her head. “When she says, ‘someone,’ does she mean you?” “I don’t know. When the hack first happened, she made it clear that she didn’t want me to resign,” Jake said. “She just wants someone to,” Fleura said, yawning. He felt bad about keeping her up—she had to catch a plane early the next morning—but she’d insisted on staying up a few more minutes and talking it through. “Whether or not you have a job next week matters to me,” she said, only half joking. “Seriously, why is Carly blowing this out of proportion? This isn’t a Target situation.” Further Reading “They Burned the House Down”: An Interview with Michael Lynton She was right. Although SimplePay processed millions of credit card transactions a day through an app that enabled merchants to accept payments by tablet or phone, the hackers had infiltrated just one database, which held only consumers’ email addresses. They hadn’t gotten financial details or any other identifiers. Still, it had been an alarming security breach. The company had been forced to take its system down for 42 hours, notify all 10 million affected consumers, and issue a public apology. Tech bloggers had jumped all over the story; many speculated that SimplePay had begun to slow its hiring and scrimp on security investments in an effort to spiff up its balance sheet for a potential IPO. Some of that was true. The plan was to go public next year, and Jake and his CFO had been trying to cut costs, but they had mostly spared the IT group. They knew that technology (and the staff to support it) was the company’s bread and butter. His head of PR, Michelle Perez, had issued statements to that effect but had trouble controlling the story. Twitter trolls had piled on, mocking SimplePay for taking nearly two days to recover from a simple hack, but Jake’s CIO, Jesse Gladstone, insisted that his team needed that much time to fully patch the vulnerability and close any access the hackers had. The IT group had been working around the clock ever since to locate and fix any other potential holes and implement new security measures. “She’s making a big deal of it because it was serious,” Jake said. “I know that,” Fleura said. “But insisting on a scapegoat seems over the top. If she doesn’t want you out, who is she talking about then? Jesse?” Jake cringed. The idea of asking his CIO to leave under these circumstances was untenable. Besides, he was proud of how Jesse and everyone else at SimplePay had handled the situation. Perhaps the response had been a bit slow, but they’d all done the best they could with the team they had and the money available. “Chances are that Carly’s just the designated messenger for the rest of the board. I’m sure someone else is behind this,” Jake said. “Like Theo,” Fleura said, getting up from the table. Ever since Theo Conrad, a prominent tech investor, had joined the board, he’d been a thorn in Jake’s side, challenging him on all but the most routine decisions. At the most recent emergency board meeting, he wouldn’t stop harping on the fact that 30% of SimplePay’s customers hadn’t used the app since the hack. “They simply don’t trust us anymore,” he’d said. “And Wall Street won’t either unless we’re completely clear about what we’re changing to make sure this never happens again.” Jake turned from his laptop to watch Fleura as she headed upstairs. “Say something else,” he called after her. “Theo’s name can’t be the last thing I hear tonight.” “Try to get some rest, honey,” she said from the stairs. Jake smiled but knew he probably wouldn’t. It’s All Under Control Now The next morning, Jake met Michelle and Jesse at Bouldin Creek Cafe at 7:30 AM. “You don’t look good, Jake,” Michelle said when she sat down. “It’s time to start sleeping again. The worst is behind us.” “I’m afraid that might not be the case,” he said, stirring two packs of sugar into his double caffè macchiato. “We’re not yet back to our prehack transaction numbers, and new customer acquisitions have all but halted. I know it’s only been a month, and things were slow before the breach, but we need to get things back on track soon.” “As far as PR goes, we’ve got it under control now,” Michelle said. She ticked off all the things the company had done right since the breach: immediately contacting people whose information had been compromised and presenting a clear, consistent message to customers, social media, and the press. Michelle had recommended that the company apologize but focus on the hackers as the ones responsible. Within the organization, she’d also started to downplay the severity of the breach, but Jake had told her to stop. He worried that the sentiment was leaking into her external messaging. “We just can’t forget that this was a big deal, Michelle,” he said. Case Study Teaching Notes Jana Seijts teaches the case on which this story is based in her Management Communication course. What drew you to this story? The original case deals with a real product many of my students are familiar with: the PlayStation. The security breach, which took place three years before the recent Sony Pictures’ hack, had potentially serious implications for Sony. I knew that the story would help my students grapple with the thorny issue of whether letting key players go helps restabilize an organization after a setback. How do your students respond to it? Most don’t see the need to find a scapegoat and instead suggest the executives outline the steps taken to date to end the crisis and how they’ll make sure it doesn’t happen again. What lessons does the case offer? One is that companies must communicate early and often with key stakeholders and craft messages that speak to each group’s needs, wants, and interests. What a customer is concerned about after a breach is very different from what an investor cares about. “Of course, it was,” Michelle responded. “But I really think it’s almost over. My phone isn’t constantly beeping at me anymore. And Kara Swisher told me yesterday that, in one sense, we should think of the hack as a badge of honor. We’re now big enough to be considered an attractive target.” She smiled; Jake and Jesse didn’t. “And Jesse’s on top of security,” she continued. “We’ve got the ‘latest, and most comprehensive, data security measures.’ Right?” “We’re getting there,” the CIO answered, staring into his coffee. Jesse had been sleeping at the office. He was a perfectionist, which made him good at his job, but in the wake of this crisis, his insistence on getting everything just right was stalling their response. While Jake and Michelle were chomping at the bit to promote the new security upgrades—a hasty yet significant and necessary investment—Jesse was still in testing mode. “When will the new features be up and running?” Jake asked. “We need another day or two,” Jesse answered. “Perfect,” Michelle said, a forced cheerfulness in her voice. “We can issue the release by the end of the week and include an update on the FBI investigation, too. And then our sales team can start to work their magic, and we can get back to business as usual. We’ve got an IPO to prepare for, after all.” Jake wondered if that was why the board was pushing so hard for a resignation: Wall Street needed a pat ending to SimplePay’s hacking story before the company could embark on a road show. Heads Must Roll “I’m sorry that so much of this is playing out over email,” Carly said to Jake when they met at her office later that afternoon. “I know this isn’t easy.” She explained that a significant majority of the board members felt that a public gesture was necessary to demonstrate how seriously SimplePay took the breach. “But we’ve done that. We explained exactly what happened and how we’re responding.” “It’s that last part that the board is concerned about. What changes are we making to ensure that our customers trust us completely again? At Target, the CIO and then the CEO resigned. When TJX had its breach in 2007, it was a director and an SVP. They’ve set the precedent. We need to do something similar so that we can put this episode behind us. SimplePay is—was—the market leader in the mobile-pay space because of its reputation for being reliable and secure. Our success is based on trust. This incident has completely eroded that.” She wasn’t wrong. The customer service department had been flooded with questions about security, and although the company had expected some level of merchant attrition, defections had been much greater than expected. And they weren’t tapering off. Carly pulled out her phone. “Did you see the study from this group, Interactions, that Theo sent around last night? ‘Twelve percent of customers say they would stop shopping at a retailer that had a security breach; about 36% say they would be less frequent patrons. About 85% of shoppers who have had their personal information stolen say they tell others about the incident; 34% complain on social media, and 20% comment directly on the company’s website.’” “And all that goes away if we fire someone?” Jake asked, getting annoyed. “That’s not what happened with Target. Their stock dropped 3% the week that Steinhafel resigned.” “They acted too late. He should’ve left much sooner. Besides, the shares have now jumped 30% under the new CEO, to all-time highs. Everyone loves a fresh start after a disaster—analysts, pundits, customers,” Carly responded. “But that’s not always necessary. Look at Zendesk, LivingSocial. They survived hacks without firing anyone.” “But our business isn’t recovering. We need to make a statement—not just new technology, new people.” “So heads must roll?” Jake asked. “Just one head.” “Well, then, it should be me,” Jake said, unsure that he believed what he was saying. “We’ve got a strong team in place. I leave, the statement is made, loud and clear, and then you all can get things back in order in time for the IPO.” “It doesn’t have to be you,” Carly responded. “If not me, then who?” Jake asked. She told him that Jesse’s name had come up first; after all, it was his systems that had been breached and his team that had been so slow to get the service back online. As a leader, Jesse had been a bit shaky under all the pressure. But a few board members had also pointed to Michelle; had she immediately grasped the severity of the situation and gotten out well ahead of the story, trust in SimplePay might not have dipped so low. “How would firing Michelle help fix anything? She may have not handled this perfectly, but letting her go won’t allay any customer concerns. And you know as well as I do that Jesse isn’t fully to blame for the situation. No IT team can predict every vulnerability or patch every hole. He did his job as best he could.” “Listen, you’ve been a great leader, sticking up for them all along, even when they didn’t deserve it,” Carly said. “But the board has made up its mind. Someone’s got to go.” Take One For the Team? Jake typed the letter out on his phone. Please rest assured that this decision was not easy, but in light of recent events, I have decided that my stepping down is in the best interest of SimplePay and its customers. While I cannot take any personal responsibility for this incident, it happened on my watch. As the company’s CEO, I am ultimately responsible and thus resign from my position, effective immediately—mostly because the board is making me do it. He pressed send, and 20 seconds later his phone rang. It was Fleura, calling from her hotel room in San Francisco. “Why in the world are you up at midnight writing a fake resignation letter?” she asked. “I do love the last line, though. If only every shamed CEO admitted that the board made him do it. But seriously, honey, you’re not resigning, are you? You love your job.” This was true. At the helm of SimplePay, Jake was happier than he’d ever been, and he certainly didn’t want to give up the opportunity to lead his first IPO. But he couldn’t imagine making anyone else the scapegoat. “How did it feel typing it out?” “Terrible,” he admitted. “I’m not ready to go, but maybe I have to take one for the team.” The Experts Respond: Should Jake resign? Forcing a resignation could actually hurt, rather than help, SimplePay’s reputation. Cary Horenfeldt is the vice president of MasterCard Processing at MasterCard, Asia Pacific. The unfortunate reality is that this sort of breach is all too common. However, while I understand why Carly and the rest of the board want to reverse the economic and reputational damage this incident has caused SimplePay, I disagree with the commonly held idea that every crisis needs a fall guy. Making Jake, or even Jesse, resign could backfire for two reasons. First, the act would shift the blame away from the real perpetrators of the crime—the fraudsters. This would, of course, be different if the hack were an inside job, but that doesn’t sound like the case. By picking an internal scapegoat, the board hopes to put the breach behind it, but the company won’t be able to move on until it fully understands what happened, why, and how it can better protect its applicable systems, before confidently communicating this to all internal and external stakeholders. Second, forcing a resignation could actually hurt, rather than help, SimplePay’s reputation. Jake and his team seem to have handled the situation reasonably well. They were transparent, told all the right people about the breach quickly, and have taken steps to mitigate any fallout. Maybe they’ve been a little slow to fix the problem, but in these cases “fast” is relative. If a senior executive leaves, it could undermine the message that the company has rebounded from the incident. Consumers and analysts might wonder, “What’s really going on there?” And then it could take even longer for SimplePay’s image to recover. Like every firm that handles payment-related information, MasterCard is vigilant against the threat of hackers. But, sadly, fraudsters have become a sophisticated group. They’re interconnected and international, so they can use information stolen from one region in another, making fraud difficult to track. And they’re constantly adapting. MasterCard leverages extensive, dynamic risk and fraud-management policies and systems, including an emergency response team on which I serve. This team manages all aspects of responses—from detection to action plans to communications—and ensures that the right activities occur at the right time. The breach at SimplePay should be an opportunity for the organization to come together—a catalyst that kicks off the development of a well-defined plan to mitigate economic and reputational damage. It doesn’t fall on just Jake and Jesse to protect the company. Everyone—from the board chair to the end user—is responsible for carefully handling data and improving security. Rather than let Michelle manage the messaging on her own, SimplePay should create a unified voice that brings together corporate communications, executive management, and operations and technology. It’s not that making the decision to fire someone is never right. But in this instance, Jake and his team need to stay put and focus on preparing for the future, securing their systems against future attacks, and getting back to business. Jake fell down on the job. He must take responsibility for his actions. Kanina Blanchard is the president of Opportunity Creation, a consultancy focused on issues and crisis management. She was a senior leader in the Ontario Ministry of the Environment and at the Dow Chemical Company. There is no doubt that SimplePay is in this situation because of a failure in operational leadership. And in the midst of the fire, with the board resolute, a resignation might be the only option. But it didn’t have to come to this. Things have changed when it comes to crisis management. Twenty or so years ago, executives called upon their PR departments to handle most public problems and rarely issued apologies, considering them weak and legally foolhardy. Since then, companies have become more transparent, and leaders now know they need to be at the forefront of crises, addressing concerns and providing answers. But that’s not what the CEO, Jake, did here. SimplePay’s incident was a relatively small breach, but it became a much bigger issue that threatened the company’s future, in large part because Jake fell down on the job. In any organization—but especially in a fast growing one like SimplePay—it’s inexcusable for the chief executive not to invest time and energy in planning for crisis and issues management. I’m not talking about a yearly exercise in which everyone writes down best practices and then puts them in a binder on a shelf. Crisis planning should be a thoughtful and continual process that involves reflection and discussion of all potential risks, lessons from other companies, and the right strategies for your particular organization. Jake should have led his team in this kind of scenario planning so that Michelle, Jesse, and everyone else knew in advance what they would do, who would do it and on what timeline—and most important, whether resignations would be on the table. At his level he should have a strong network of mentors, peers, and experts to counsel him. Leadership can be lonely, but good leaders have the humility to ask for help from trusted advisers. If Jake had put a strategy in place, Michelle could have been more deliberate about helping him engage with customers and the media, and Jesse’s work to restore service may have gone more quickly. The breach could have been a blip on the radar, but instead it has gathered steam. We took potential risks extremely seriously at the Dow Chemical Company, where I worked for 20 years, because the stakes are so high in that business. If systems failed, there was potential for environmental damage or loss of human life. But even when the risks aren’t so extreme, companies should prepare for them thoroughly. The theft of personal information must also be taken seriously. Whether your company is a local flower shop or a global industrial player, it needs to have a crisis management plan. Unfortunately, Jake can’t turn back the clock. He must instead lead with humility and take responsibility for his actions. That may very well mean resigning or at least rolling up his sleeves and making sure the company learns from his mistakes and is better prepared the next time. Comments from the HBR.org community The Die Has Been Cast Let’s remember, the board has the final word. The decision stinks, but the board has spoken: Someone at the top has to go. SimplePay needs to reverse its vicious cycle before it becomes a death spiral. Jake should make it clear to the directors that, as their subordinate, he will carry out their orders, just as he expects everyone else at SimplePay to carry out his. —Jeffrey Deutsch, founder, A SPLINT Resigning Will Send a Message If Jake fires either Jesse or Michelle, SimplePay might not be better off, because their replacements will need months to come up to speed. But if the board insists on someone’s head, Jake can only offer his own. If he resigns himself, he’s making a statement: that he believes in his team. —Teg Rood, principal, Rood Consulting SimplePay Has Other Options Firing someone is not the only way to send a strong message. The company could rebrand with a marketing campaign or update its mobile processing system with new designs and security features that are clearly visible to customers. All this will be for naught, however, if the app is hacked again. To restore customer trust, the company must continue to improve security. —Alvin Tsui, development analyst, Qualicom Innovations Don’t Jettison Your Talent There is no upside to making someone take a fall for appearances. If Jake had been incompetent, he would have to go. But he appears to be a capable executive, and it doesn’t make sense to lose talent, especially in tough times when the company needs a leader. —Robin Cohn, author, The PR Crisis Bible HBR’s fictionalized case studies present dilemmas faced by leaders in real companies and offer solutions from experts. This one is based on the Ivey Business School Case Study on a Sony hack that occurred long before the one late last year: “Sony PlayStation: Security Breach” (case no. W12309), by Jana Seijts and Paul Bigus.

Case Study: After a Crisis, Who Should Take the Fall?

Partner Center