When Systems Fail, the Crisis Begins: Why a Cyberattack Is Not Just an IT Problem
You are on a plane, just minutes away from landing at Bucharest’s Henri Coandă International Airport.
Suddenly, a cyberattack hits the air traffic control system. It sounds like the opening scene of a film. Unfortunately, the possibility no longer feels entirely implausible.
A Technical Failure Can Disrupt an Entire Infrastructure
On 8 September 2026, a technical failure in the UK’s flight-processing system caused severe disruption across the country. More than 1,000 flights were reportedly cancelled, affecting airports including Heathrow, Gatwick, Stansted, Manchester, Birmingham, and Edinburgh.
Britain’s air traffic control provider, NATS, said it resolved the problem later that day. Airports and airlines nevertheless continued dealing with the resulting backlog, displaced aircraft, unavailable crews and stranded passengers.
NATS described the incident as a technical problem with its flight-processing system. No evidence has been presented that it was caused by a cyberattack. But we can make our assumptions.
Two Different Incidents, One Important Warning
Less than two weeks earlier, Manchester Airports Group confirmed that an unauthorised third party had obtained customer data associated with airport parking, lounge and Fast Track bookings, as well as airport Wi-Fi registrations.
The compromised information included email addresses, telephone numbers, vehicle registrations and postcodes. Subsequent reporting indicated that approximately 8.7 million people may have been affected.
These were two different events: one confirmed cyber incident involving customer data and one major technical failure affecting flight operations.
Together, however, they demonstrate how dependent modern organisations have become on complex digital infrastructure.
And when that infrastructure fails, the consequences are not just for the IT department.
A Cyber Incident Quickly Becomes a Business Crisis
A cyberattack becomes a business crisis when it affects an organisation’s ability to operate, protect people, fulfil obligations or maintain stakeholder confidence.
The transition can happen within minutes.
Systems become unavailable. Employees lose access to essential tools. Customer transactions stop. Personal information may be exposed. Suppliers cannot connect to company platforms. Journalists begin asking questions before the organisation has even established exactly what happened.
At that point, the incident is no longer defined solely by its technical cause. It is defined by its operational, financial, legal and reputational consequences.
This is why effective crisis management cannot begin only after the technical team has solved the problem.
IT Cannot Answer Every Question the Organisation Faces
Technical teams must investigate the intrusion, contain the threat and restore affected systems.
But they cannot independently decide:
What customers should be told and when
How employees should respond to external questions
Whether operations should continue or be suspended
When the company should make a public statement
Which regulators and national authorities must be notified
How preliminary findings should be communicated
Who approves messages when the facts change from one hour to the next
Those are enterprise decisions.
They require coordination between executive leadership, IT, cybersecurity, operations, legal, compliance, customer service, HR and communications.
If these functions meet for the first time during an attack, the organisation is already behind.
AI Is Changing the Cyber Threat
Artificial intelligence is making several elements of cyber intrusion faster, cheaper, more accessible and more scalable.
The UK National Cyber Security Centre has reported that threat actors are already using AI for reconnaissance, vulnerability research, exploit development, social engineering, basic malware generation and analysis of stolen data.
AI does not suddenly turn every attacker into an elite hacker. But it can reduce barriers, increase speed and allow existing attack techniques to be deployed at far greater scale.
And AI may only be one part of the technological shift ahead.
Quantum Computing Could Create an Even Bigger Cybersecurity Challenge
Quantum computing presents a different type of risk.
Sufficiently powerful quantum computers could eventually break much of the public-key cryptography currently used to protect confidential communications, digital identities, software updates, financial transactions and sensitive corporate information.
Cryptographically relevant quantum computers do not yet exist, and predictions about when they will arrive vary considerably.
But the risk begins before the technology becomes operational.
“Harvest Now, Decrypt Later”
Attackers can potentially collect encrypted information today and retain it until future quantum technology allows them to decrypt it.
The strategy is known as “harvest now, decrypt later".
It is particularly relevant for information that must remain confidential for many years: government information, intellectual property, strategic corporate data, financial information and other sensitive records.
This means quantum readiness is not simply a problem for some distant future.
NIST has already finalised its first post-quantum cryptography standards, while the UK National Cyber Security Centre recommends organisations begin cryptographic discovery and migration planning well before quantum computers capable of breaking current encryption become available.
For boards and leadership teams, the lesson is important:
While AI is already making existing cyber techniques faster and more scalable, future quantum computers could undermine some of the encryption on which digital trust currently depends.
Cyber resilience therefore needs to consider not only the attacks organisations face today but also the technologies that could fundamentally alter the threat environment tomorrow.
Cyber Risk Is Also a Geopolitical Risk
Cyberattacks are no longer used purely for financial crime.
They can be instruments of espionage, disruption, sabotage and geopolitical pressure.
The dividing line between criminal activity, state-sponsored operations and hybrid conflict is not always immediately visible to the organisation being targeted.
This does not mean every outage is a cyberattack or every cyberattack is geopolitical.
It means boards must prepare for an environment in which operational resilience, cybersecurity, reputation and even national security increasingly intersect.
Understanding the wider environment in which an organisation operates is therefore an important part of market and risk intelligence.
Why Treating Cyberattacks as IT Problems Creates a Dangerous Gap
Discussions with our colleagues across the Crisis Communications Network Europe have highlighted a recurring concern: many Romanian organisations still approach cyber incidents primarily as technical events.
When ownership sits almost exclusively with IT, communication planning often begins too late.
The organisation may have backup systems and security procedures but no agreed stakeholder messages, approval process or communication chain of command.
Executives may assume IT will decide when the organisation should speak.
IT may assume communications and legal will handle external scrutiny.
Communications may wait for definitive technical information that will not be available for days or even weeks.
The result is a decision vacuum at precisely the moment when employees, customers, partners, regulators and journalists expect clarity.
Cyber Crisis Communication Must Be Prepared in Advance
The purpose of cyber crisis preparedness is not to predict every possible attack.
It is to establish how the organisation will make decisions under pressure and communicate responsibly despite incomplete information.
A credible cyber crisis communication plan should establish:
Who has authority to activate the crisis team
Which executives and functions must participate
Who contacts relevant authorities, including Romania’s National Cyber Security Directorate (DNSC)
How technical information will be verified before publication
Who approves internal and external communications
Which stakeholders must be contacted first
What channels remain available if company systems are inaccessible
How incorrect or outdated information will be corrected
Who monitors misinformation, impersonation and fraudulent messages
How communication decisions and approvals will be documented
This is precisely why crisis communication planning needs to happen before an incident occurs.
Prepare Communications Before You Need Them
A holding statement should acknowledge what the organisation knows, explain what it is doing and tell affected stakeholders where they can obtain reliable updates.
It should not speculate about attribution, promise an unrealistic recovery time or minimise possible consequences before an investigation is complete.
In a cyber crisis, speed matters.
But credibility matters more.
Test the Plan Under Realistic Pressure
A crisis plan sitting on a shared drive is not evidence of preparedness — particularly if the cyberattack makes that same drive inaccessible.
Realistic crisis simulation exercises should test what happens when senior leaders are travelling, normal communication platforms are offline, technical information conflicts and screenshots of internal messages appear on social media.
That is how organisations discover unclear responsibilities and approval bottlenecks before a genuine crisis exposes them.
Communication Does Not End When the Systems Come Back Online
Technical recovery does not automatically end the crisis.
Customers may remain exposed to phishing or identity fraud. Employees may still lack confidence in internal systems. Regulators may require further information. Journalists will ask whether warnings were missed and whether the organisation’s initial statements were accurate.
Rebuilding stakeholder confidence can therefore become a reputation managementchallenge long after the technical incident has been contained.
Recovery communication should explain what changed, what affected stakeholders need to do and how the organisation is reducing the likelihood or impact of another incident.
The objective is not to declare victory as quickly as possible.
It is to demonstrate control, accountability and sustained attention.
If Your IT Systems Fail Tomorrow, Will Everyone Know What to Do?
Cyber incidents remain the leading global business risk for the fifth consecutive year, according to the Allianz Risk Barometer 2026.
Yet preparedness cannot be delegated to one technical function.
Lighthouse PR Agency helps companies prepare for and communicate through major business and reputational crises, including cyberattacks, data breaches and major business interruptions. No organisation can eliminate every cyber risk.
And the convergence of AI, geopolitical instability and, eventually, quantum computing means the threat environment is likely to become more complex, not less.
But an organisation can determine whether the first critical minutes of a crisis are spent following an established plan — or arguing about who should make the decisions.
If your IT systems fail tomorrow, does everyone in your organisation know exactly what to do, what to say and who has the authority to act?
———
About the Author
Ana Maria Gardiner is a senior communications executive, board-level adviser and founder of Lighthouse PR. With extensive experience providing strategic counsel to multinational organisations and leadership teams, her expertise spans corporate reputation, public relations, marketing communications, crisis management and high-stakes communications.
Throughout her career, Ana Maria has led and implemented communications strategies for organisations including JPMorgan, Coca-Cola, ExxonMobil, Siemens Energy, HEINEKEN, Carrefour, Lexus, Franklin Templeton, BNP Paribas, Sungrow, XTB, Bitget, EssilorLuxottica and Pfizer. Her experience encompasses projects across the Middle East, North Africa, and Central and Eastern Europe, covering a broad range of industries and business environments.
She currently works closely with senior executives and board-level decision-makers, advising Lighthouse PR clients on reputation management, strategic positioning, communications risk management, and the development of responses to sensitive situations and crises.
Ana Maria holds a bachelor’s degree in Political Science and a master’s degree in European Affairs.
About Lighthouse PR
Lighthouse PR is an independent public relations and strategic communications consultancy headquartered in Bucharest, working with organisations across Romania, Central Europe, and Southeastern Europe. The agency provides senior-led counsel to companies operating in financial services, energy, manufacturing, technology and cybersecurity, transport and logistics, retail, and FMCG.
Its portfolio of services includes media relations, corporate communications, reputation management, crisis communications, crisis preparedness and response, stakeholder and investor communications, social media and influencer management, B2B communications, risk assessments, business continuity planning, resilience framework development, media buying, corporate events, and SEO and website design services.
Lighthouse PR holds ISO 9001 and ISO 27001 certifications and is the exclusive representative for Romania and the Republic of Moldova of Eurocom Worldwide and Crisis Communication Network Europe, two international networks that strengthen the agency’s capacity to manage communications projects and crises with regional and international dimensions.
Through its consultancy model, Lighthouse PR places senior expertise at the heart of every client relationship, from strategy development and reputation management to the implementation of communications programmes and the coordination of responses in sensitive situations.
Lighthouse PR: Clear. Concise. Convincing.
