Crisis response: the first answer, and what it costs later

The $9.1 million that became $6 billion

In July 2018, 3M paid $9.1 million to settle a Justice Department claim that it had sold earplugs to the U.S. military without disclosing that they were too short to fit properly. It admitted nothing, and the problem seemed to be over.

It was not over. Lawsuits over the same earplugs were gathered into one federal case in 2019. In July 2022, 3M put its subsidiary Aearo Technologies into bankruptcy, proposing a fund of about $1 billion to settle them all.

In June 2023 a bankruptcy judge threw the filing out. Aearo was financially healthy, he ruled. In the court's words, the bankruptcy had

“no valid reorganization purpose”The bankruptcy court, June 2023, as recorded in the 3M case

Two months later 3M agreed to pay $6.0 billion, about six times its opening offer.

That is the whole decision in two numbers. The first answer was sized to the version of the problem 3M could see in 2018. The last was set after a court took away the shield. Most of the companies in this guide faced the same choice in their first days, before anyone knew how big the problem was: how much to admit, how much to pay, and who would answer for it.

What crisis response is

The crisis itself is often not a choice: a spill, a hack, a boycott, a defective part. The response is. It is a handful of decisions made fast and in public, and they are often what people remember: not the breach, but how long the company waited to admit it.

Why it is so hard

Every crisis plan says the same things: be fast, be honest, take responsibility. Three things make that hard in practice.

The ways companies did it

The responses on record take four shapes. Most companies picked one in the first days.

What 77 companies did

Here is every response on record, placed by the year it was made and marked by how it turned out. Hover a mark, or open the table, for the company and the outcome.

Of the 75 responses that can be judged, 58 were never undone, 7 were walked back and 10 were kept only in part.

Read "never undone" with care here. BP's minimizing, Toyota's false timeline and Uber's payment to hide a breach were all never undone. They stood until someone found out, and then the bill came: for Toyota, a $1.2 billion criminal penalty; for Uber, $148 million to settle with all 50 states.

3M's earplug crisis appears twice, as two separate decisions four years apart: the 2018 settlement, which stood, and the 2022 bankruptcy filing, which a judge threw out.

The walk-backs

Put the walk-backs side by side and most share one feature: the first answer was the smallest one available. Cap the bill, call it controllable, keep the team, keep selling, stay quiet. And in most of them the company did not change its own mind. Someone outside changed it: a court, a regulator, investors, employees.

The cost of starting small shows in the numbers. 3M's bankruptcy maneuver proposed a fund of about $1 billion; once a judge threw it out, 3M settled for $6.0 billion. Volkswagen called the fallout controllable; by mid-2020 it had cost more than 30 billion euros. Rio Tinto's decision to keep its executives lasted three weeks.

The responses that held up look different. They drew a line early and kept to it. Apple said in public, on the day of the court order, what it would not build and why. Norsk Hydro said the day after the attack that it would not pay, and then briefed the press every day after.

A small first answer is only cheap if the problem is small.

What the share price did

For many of the responses there is a clean market record: the company's total return over the three years after the decision, against the S&P 500.

Treat this chart as context, not a verdict: a crisis is rarely the only thing moving a share price over three years. Nike's shares fell just over 3% the day after its Kaepernick campaign was revealed, and beat the index by 40 points over the next three years. Etsy kept its fee increase through a seller strike and its own filing credited the fee for revenue growth, yet its shares trailed the index by 88.2 points.

How to run this decision

If you are facing a version of this, here is what the record suggests doing, in order.

1. Size the response to the worst credible version

   The first estimate is almost always the smallest one. Write down what the problem costs if the worst plausible version turns out to be true, and size the first answer to that. BP's first public estimate of the spill was about 1,000 barrels a day; the peak was roughly 62,000. Nokia did the opposite in March 2000: when a fire hit a Philips chip plant, it read the supplier's reassuring report as a warning, escalated within days and lined up other chip capacity. Ericsson took the same report at face value, and the shortage severely damaged its phone business.

   Seen in: BP, 2010 · Nokia, 2000 · Xerox, 2002
2. Disclose before someone else does

   If outsiders break the news, the story becomes what you hid. A security blogger reported Target's breach a day before Target confirmed it. Uber hid its 2016 breach for a year after paying the hackers $100,000, and later paid $148 million to settle with all 50 states.

   Seen in: Target, 2013 · Uber, 2016 · Capital One, 2019
3. Say what you will not do, and why

   A boundary stated early and in public gives the response a spine that later pressure has trouble bending. Apple refused to build software to unlock a phone and said why on the day of the order. Coinbase refused a ransom in one sentence: "We will not fund criminal activity."

   Seen in: Apple, 2016 · Norsk Hydro, 2019 · Coinbase, 2025
4. Keep the people at the center away from their own consequences

   When the executives involved help decide what happens to them, the answer tends to be small, and someone else ends up changing it. Rio Tinto docked bonuses and kept its team; three weeks later the executives were gone. Boeing fired its CEO with no severance, and he still left with about $62 million.

   Seen in: Rio Tinto, 2020 · Boeing, 2019 · Stellantis, 2024
5. Don't write a statement designed to offend no one

   A statement that takes no position reads as a position anyway, and usually the wrong one. Anheuser-Busch's CEO wrote "We never intended to be part of a discussion that divides people" and was criticized from both sides. North America revenue fell about $1.4 billion in 2023, mostly on Bud Light.

   Seen in: Anheuser-Busch InBev, 2023
6. Don't pin the blame on a vendor or a customer when you share it

   Blaming bots, a supplier or customers' passwords may hold in a press release, but it invites the scrutiny that finds the rest. Delta blamed CrowdStrike, while Microsoft's lawyer said Delta's crew system ran on IBM infrastructure. 23andMe blamed users who had reused passwords, and filed for bankruptcy in 2025.

   Seen in: Delta, 2024 · 23andMe, 2023 · Live Nation, 2022
7. Set a date to re-decide, and give it to someone outside the response

   A first posture survives by default unless someone is told to reopen it. Merck kept selling Vioxx after a 2001 warning letter and withdrew it worldwide only in 2004. Volkswagen's board judged its diesel fallout controllable until regulators went public.

   Seen in: Merck, 2001 · Volkswagen, 2015

To work the numbers for your own case, read Corporate crisis response: what one more quarter of delay costs.

Warning signs

What it has looked like when this decision was going wrong.

• The first public number is the smallest one available.BP, 2010 · 3M, 2018
• A problem the company knows about is described as one that may happen.Meta, 2018
• The response blames customers, a vendor or bots.23andMe, 2023 · Delta, 2024 · Live Nation, 2022
• The people being judged help set their own consequences.Rio Tinto, 2020 · Stellantis, 2024
• A risk manager's no is overruled for a client's fees.Credit Suisse, 2021

All 77 cases

Each case is one company at one decision: what was on the table, what it chose, why, and what followed, with every fact sourced.

Questions

What is crisis response in business?

The decisions a company makes in the days and weeks after something goes badly and publicly wrong: what it admits, what it pays, who is held responsible, and what it changes. The crisis is often not a choice. The response is.

What are examples of good crisis responses?

Norsk Hydro refused a ransom in 2019, recovered from backups and briefed the press daily. Maersk reinstalled 4,000 servers and 45,000 PCs in about ten days after a 2017 cyberattack. Apple refused in 2016 to build software to unlock an iPhone, and said why in public. Chipotle closed 43 restaurants in Oregon and Washington during a 2015 E. coli outbreak, though only eight had been linked to it.

What are examples of bad crisis responses?

BP's first estimate of its 2010 spill was about 1,000 barrels a day, against a peak of roughly 62,000. Volkswagen judged its diesel fallout controllable; by mid-2020 it had cost more than 30 billion euros. Uber paid hackers $100,000 and hid its breach for a year.

Should a company pay a ransom?

The record shows both choices. Colonial Pipeline paid $4.4 million on the day of its 2021 attack and still stayed shut for six days. Norsk Hydro and Coinbase refused and paid for recovery instead: Coinbase recorded $307 million of costs in a single quarter.