What rebuilds customer trust after a cyberattack? Proof, not apologies

Key findings

• 57% of consumers say proof that security had been improved would do the most to restore their trust.
• 15% say a clear explanation of exactly what happened.
• 12% say financial compensation.
• 1% say an apology from senior leadership.
• 2% say nothing would work and trust would be permanently damaged.

What do customers want from a company after a data breach?

Evidence that it won't happen again. We asked consumers what would do the most to restore their trust in a company following a cyberattack. More than half (57%) choose proof that its security had been improved. No other answer comes close.

A clear explanation of what happened is second on 15%, followed by financial compensation on 12% and immediate notification on 7%.

Does an apology help after a data breach?

Not much on its own. Only 1% of consumers say an apology from senior leadership would do the most to restore their trust. That puts it last, behind free credit monitoring (2%).

This does not mean a company shouldn't apologise. Respondents picked the single thing that would matter most, and an apology may still be expected. But it is not what brings customers back.

Does compensation restore trust?

For about one in eight. 12% say financial compensation would do the most, which is roughly a fifth of the number who choose proof of better security.

Is trust permanently lost after a cyberattack?

Rarely. Only 2% say nothing would restore their trust. That fits with our finding that just 4% of consumers would stop using a breached company permanently, while 46% would stop until they felt confident the issue was resolved.

What this means for comms teams

The standard breach playbook leads with the statement and the apology. Customers are asking for something that arrives later and takes more work: a visible fix.

That changes what a recovery plan should contain.

1. Plan the second announcement before you need the first. The apology is day one. The proof is the message that ends the pause.
2. Make the fix specific. "We take security seriously" is not proof. Say what changed, when, and how a customer can see it.
3. Don't over-invest in the wrong signals. Credit monitoring and audits rank low as the main trust-builder (2% and 4%). They may support the story. They are not the story.

One caution on the audit figure. Independent verification scores 4% when it competes with "proof that security had been improved". An audit may well be how a company supplies that proof.

Frequently asked questions

What restores customer trust after a cyberattack?

Proof that security has been improved. 57% of consumers in The Reality Department's polling say this would do the most to restore their trust.

Should the CEO apologise after a data breach?

An apology may be expected, but only 1% of consumers say an apology from senior leadership is the thing that would do most to restore their trust.

Do customers want compensation after a data breach?

12% say financial compensation would do the most to restore their trust.

Methodology

The Reality Department surveyed 500 nationally representative UK consumers. Fieldwork: October 2026. Respondents chose one answer. Figures may not sum to 100% due to rounding.

Related: Do customers leave after a data breach?

Want to test your own crisis messaging with customers? Work with us.