Orange : Protecting details

Online plays no part in the public response to a reputation-harming incident.

click to view

The feature

Orange, France-based telecommunications provider, has left its online channels out of its response to a large-scale theft of customer data.

Orange has no confirmation on its global or leading market sites of its admission to the media on Tuesday (6 May) that personal details of 1.3 million of its customers had been stolen by data hackers in mid-April in an attack similar to one affecting 0.8 million customers earlier in the year. No payment or credit card details were involved, the company was quoted as saying.

Searches on Google for ‘Orange personal data theft’ return a first page of results linked to coverage in media outlets of the data theft story. On the Orange corporate site the latest news release predates the emergence of the story; and there are no related posts in its social media channels or indications that information is available either publicly or to customers. The company told the media that it had contacted all customers affected by the theft.

The takeaway

There has been some sympathy for Orange along the lines that the bad guys are generally running one step ahead of the strenuous measures big companies do take to combat data theft. But while that means whatever it learned from the first attack of the year might not have been able to save it from a return raid, there’s less excuse this time round for rolling out an analog response based on statements to journalists and direct communication with customers whose personal data was stolen.

The big issue here for Orange is not just customer relationship management – and even as that its response is too limited – but also reputation management in the wake of a second serious incident. Once the news of the theft was out, all Orange customers were going to want to know if they were among those directly affected this time; many will have gone to the company’s website looking for information – and will have found none, not even an advisory to log-in to their account or check their e-mails for a message from the company. With the foresight of recent experience, Orange should have been ready to use its online channels as a platform for explaining the events on its own terms, iterating its data protection regime and giving or pointing to relevant advice. Instead, it has entrusted its reputation to news outlets, forums, social media and whatever information sources surface on Google. Unwittingly, Orange even encourages the rush to other sources of information – its own search engine is ‘powered’ by Google, so offers an option to frustrated enquirers to search the web beyond the Orange site.
First published 08 May, 2014
< Back to Tips