Historical data breaches are resurfacing in AI-generated answers when consumers evaluate whether to trust or purchase from an organisation, potentially extending their reputational impact long after the incidents have been resolved, according to a new report by Sefiani, part of Clarity Global.
The research, Cyber Breaches and Reputation Response in the AI Era, combined a nationally representative YouGov survey of 1,019 Australian adults, conducted between 19 and 24 August 2026, with an analysis of how three AI search tools reference historical cyber incidents across different stages of the customer journey.
Using its Surfacd AI visibility tool, Sefiani examined three organisations that had experienced significant data breaches: a global law firm, a global logistics company, and an Australian private health insurer. The analysis tested 30 prompts per organisation across ChatGPT, Google AI Mode, and Google AI Overviews.
The findings suggest that while consumers may be willing to remain with organisations following a data breach, the way a company communicates its response and subsequent improvements can have lasting reputational implications.
Breach visibility increases closer to purchase decisions
The study found that historical data breaches were rarely mentioned in AI-generated responses during the initial stages of customer research but became increasingly visible as queries shifted towards evaluating specific organisations.
During the category discovery stage, past breaches appeared in an average of 2.7 per cent of AI responses across the three organisations. This increased to 13.1 per cent during brand validation and 42.2 per cent at the decision stage, when users asked more directly about an organisation's trustworthiness.
For one organisation, breach history appeared in 59.1 per cent of decision-stage responses.
The research also found that AI responses did not exclusively frame historical breaches negatively. Some answers referenced how organisations restored services, improved security, or responded to incidents.
According to Sefiani, this means organisations need to consider how their handling of an incident continues to be represented publicly, even after the immediate crisis has been resolved.
Customer loyalty depends on the response
The YouGov survey found that 31 per cent of Australian respondents said they would stop using an organisation following a data breach, while 53 per cent said they might stop.
However, the research identified a gap between stated intentions and reported behaviour, suggesting that experiencing a data breach does not necessarily result in customers abandoning an organisation.
Among all respondents, 57 per cent had been customers of an organisation that experienced a breach. The report found that 13 per cent had moved to another provider, while 24 per cent considered leaving but stayed, and 20 per cent did not consider leaving.
When asked what would influence their decision to continue using a company following a breach, respondents identified measures taken to prevent another incident as the most important factor (39 per cent). This was followed by the seriousness of the breach (32 per cent), the type of customer information affected (32 per cent), transparent communications about what happened (30 per cent), and support offered to affected customers (29 per cent).
The study also tested how descriptions of an organisation's breach response in AI-generated answers could influence purchasing intentions.
When respondents were presented with a scenario in which AI reported that an organisation had been slow to notify customers and lacked transparency, 28 per cent said they would purchase from it. This increased to 57 per cent when the AI response described prompt customer notification, clear explanations, and practical support.
By comparison, 67 per cent said they would purchase from an organisation that was generally well reviewed, with no data breaches mentioned.
Where AI draws its information from
Sefiani also examined the information sources referenced by AI when generating answers about the three organisations.
Corporate content, including company websites and owned reports, appeared most frequently, referenced in 88 per cent of responses. Editorial media coverage followed at 61 per cent, while government and regulatory sources appeared in 55 per cent, and user-generated content, including social media, in 36 per cent.
The report noted that the source mix varied depending on the sector and the nature of the query.
These findings highlight the role of both owned communications and independent third-party information in shaping how AI presents an organisation's reputation.
According to Sefiani, organisations that stop communicating publicly once a breach has been resolved risk leaving AI tools to draw on historical media reports and other third-party commentary without access to an updated account of the company's response.
Sefiani's Managing Partner, Mandy Galmes, said organisations should consider what information remains publicly available after the immediate incident has passed.
"Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third party commentary appeared."
Updating the crisis communications playbook
The report argued that established cyber crisis communications practices, including timely disclosure, factual updates, and customer support, remain important but need to account for how AI tools retrieve information long after an incident.
It proposed five additional considerations for organisations managing cyber incidents:
-
Publish a factual account of the incident and response: Maintain an accessible summary on owned channels outlining what happened, how customers were supported and what has changed to reduce the risk of recurrence.
-
Engage with credible editorial media: Consider providing journalists with a factual account of the organisation's response, remediation and lessons learned to create an independent record.
-
Maintain customer support beyond the immediate incident: Recognise that customer experiences may continue to influence reviews, social media discussions and other content used by AI.
-
Share lessons with industry stakeholders: Work with industry bodies and peers to communicate relevant learnings that could support broader cyber preparedness.
-
Monitor AI-generated responses over time: Assess how AI platforms describe the organisation before and after an incident, including which sources and narratives they reference.
Co-founder and CEO of NSB Cyber, Shane Bell, highlighted the importance of communications during the initial response.
"Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre. Organisations that struggle are the ones least prepared to talk to the regulators, suppliers, partners and customers," he said.
What communications professionals need to know
The research suggests that the reputational consequences of cyber incidents may extend beyond the traditional news cycle, particularly as AI tools increasingly draw on historical information when responding to questions about organisational trustworthiness.
For PR and communications professionals, the findings point to the importance of maintaining an accurate, accessible record of an organisation's response and remediation, alongside continued engagement with customers and relevant stakeholders.
For media professionals, the study highlights the potential longer-term role of editorial coverage as a source of information in AI-generated assessments of organisations.
The findings also suggest that post-crisis communications should not be measured solely by the immediate public response. Monitoring how past incidents and subsequent corrective actions are represented across AI platforms may become another consideration in long-term reputation management.
.jpg)
