Crisis communication examples: 4 recent cases PR teams can learn from
Four recent crisis communication examples from Delta, M&S, Cracker Barrel, and Sonos, with practical lessons PR teams can reuse.
Crisis communication gets easier to explain when there is a real response to inspect. The useful crisis communication examples are not the ones with the biggest scandal or the cleverest apology. They are the ones that show what a team did when facts were incomplete, attention was moving fast, and different audiences needed different things from the company.
That is the standard used here. Each case is recent, each response can be traced to a primary source, and each one shows a different communication job: acknowledging an accident, handling a leadership issue, reversing a brand decision, or rebuilding trust after a product failure. The goal is not to hand out perfect-response awards. It is to see which moves PR teams can actually reuse.
Key Takeaways
- Strong crisis communication separates confirmed facts from interpretation and tells people where the next update will come from.
- Operational action matters more than polished wording because audiences judge whether the company changed anything after speaking.
- The best response format depends on the crisis, but ownership, update discipline, stakeholder care, and clear next steps show up repeatedly.
Table of contents
Jump to each section:
- What makes a crisis communication example useful?
- What did Delta get right after Flight 4819?
- How did Marks and Spencer communicate through its 2025 cyber incident?
- Why did Cracker Barrel reverse its logo change?
- What did Sonos do when an apology was not enough?
- What do these crisis communication examples have in common?
- How should PR teams apply the lessons before the next crisis?
What makes a crisis communication example useful?
A useful crisis communication example shows the decision sequence behind the response: what the organization knew, what it said, what it did, and how it kept stakeholders updated as the situation changed.
Most crisis roundups flatten everything into good and bad examples. That misses the hard part. A response can be fast but vague, empathetic but operationally empty, technically accurate but impossible for a normal person to understand, or beautifully written after the audience has already spent two days guessing.
A more useful test is whether the organization reduced uncertainty. The CDC's updated risk communication guidance says crisis communication needs to happen quickly and address a high level of public concern, while effective risk communication should state what is known and still unknown. That distinction is explicit in the CDC's September 2026 guidance. For a company, that translates into a simple rule: do not wait for every answer before acknowledging the problem, but do not fill the gaps with speculation either.
The four cases below are deliberately different. Delta was dealing with an aviation accident. M&S had a cyber incident disrupting customer services. Cracker Barrel faced backlash over a brand change. Sonos was trying to recover from a product experience that had damaged customer trust. The common thread is not the crisis type. It is how the communication connected words to action.
What did Delta get right after Flight 4819?
Delta's response centered confirmed facts, affected people, a single update location, and clear boundaries around what the company could responsibly say while an investigation was still underway.
On February 17, 2025, Delta Connection Flight 4819, operated by Endeavor Air, was involved in an accident at Toronto Pearson International Airport. Delta's first public update did not try to explain the cause. It said the company was aware of reports, was working to confirm details, and would publish current information through its own news hub.
That first move matters. The company created an official source before it had a complete story. As more information was verified, Delta updated the same page with confirmed facts, customer support information, operational guidance, and later a correction of false claims spreading online about the flight crew. The company also drew a firm line around the investigation, saying it would not speculate while the Transportation Safety Board of Canada continued its work. Delta's running Flight 4819 notice shows that update sequence directly.
For PR teams, the lesson is not that every crisis needs a live newsroom page. The lesson is to decide where the source of truth lives and keep directing audiences back to it. That reduces the number of competing versions the company creates itself. It also gives journalists, employees, customers, and partners one place to check before repeating an outdated statement.
Delta's language also kept returning to the people affected rather than turning the accident into a stage for corporate self-defense. In a serious incident, that priority order matters more than sounding polished.
How did Marks and Spencer communicate through its 2025 cyber incident?
M&S used short operational updates to tell customers what was disrupted, what remained available, what action customers needed to take, and when the company would update again as recovery progressed.
In April 2025, Marks & Spencer was managing a cyber incident that disrupted parts of its retail operation. The first communication job was not to explain the attack before the investigation was complete. It was to help customers understand what still worked and what did not.
M&S did that with practical updates. It told customers that stores remained open, explained changes to contactless payments and Click & Collect, and said some processes had been moved offline to protect customers, colleagues, partners, suppliers, and the business. Its April 23 update also promised to continue updating as the company worked to restore services. Two days later, M&S said it had paused online orders while keeping products browsable online and stores open, giving customers a clearer picture of what the incident meant in practice.
The useful lesson is the specificity. M&S translated a technical incident into customer consequences instead of filling the statement with cybersecurity language. It separated operational facts from the unanswered questions about the attack itself. That made the communication useful even while the technical response was still underway.
Later reporting in the company's full-year results connected the incident to recovery work and financial impact, showing how a crisis response can move from immediate service updates to a more complete business account once the facts are stable.
Why did Cracker Barrel reverse its logo change?
Cracker Barrel treated customer backlash as a signal to reverse part of its brand refresh, then publicly connected that reversal to a broader shift back toward the guest experience.
Brand backlash is a different kind of crisis because there may be no safety incident, outage, or executive misconduct. The pressure comes from identity. Customers can interpret a visual change as evidence that the company no longer understands what they value about the brand.
Cracker Barrel ran into that problem in 2025 during a broader brand refresh. The useful part of its response was not a clever defense of the redesign. The company eventually reversed the logo change and paused parts of its remodel effort. In its September 2025 results announcement, CEO Julie Masino said the company had heard guest feedback and was switching back to the "Old Timer" logo while increasing focus on food and guest experience. Cracker Barrel's own release records the reversal and the reasoning.
That is a useful crisis move because the response changed the operating decision. Listening only counts when people can see what changed because of the feedback. The company did not need every critic to agree with the original refresh strategy. It needed to show that it understood which part of the change had become a trust problem.
Reversal is not automatically the right response to backlash. PR still has to separate a temporary social-media spike from a real stakeholder problem, then advise leadership on whether the underlying decision still makes sense.
What did Sonos do when an apology was not enough?
Sonos paired its app apology with concrete product, testing, governance, and customer-experience commitments, turning the response from a message into a set of changes people could monitor.
Sonos spent much of 2024 dealing with backlash over a redesigned app that frustrated customers and removed or disrupted expected functionality. By October 1, the company had moved beyond a CEO apology and published a broader set of commitments based on an internal review of the release.
The important part is the specificity. Sonos said it would tighten pre-launch quality standards, expand testing, roll out major changes more gradually, create a quality ombudsperson role, keep improving the app on a regular cadence, and add a customer advisory board. It also tied executive incentives to progress on rebuilding product quality and customer trust. Sonos published those commitments through its investor channel.
This is the difference between an apology and a recovery plan. An apology says the company understands the disappointment. A recovery plan gives customers something observable. In product crises, the strongest communication asset is often the operating change itself. PR's job is to make that change clear, specific, and easy to follow without overselling how quickly trust will return.
Sonos also shows why timing matters. The company did not start with the final recovery architecture. It had to move from initial response to a more substantial set of commitments. Crisis communication is often a sequence, not one statement. Teams should plan for the second, third, and fourth update before the first statement goes out.
What do these crisis communication examples have in common?
The four cases differ in severity and context, but each useful response connects communication to a visible decision, an update path, or an operational action that reduces uncertainty for stakeholders.
The fastest way to compare them is to look at the job each response had to do.
| Case | Communication job | Reusable lesson |
|---|---|---|
| Delta Flight 4819 | Inform during an active incident without speculating on cause | Create one source of truth, update it, and separate confirmed facts from investigation |
| M&S cyber incident | Explain service disruption while technical recovery is still underway | Translate a technical incident into clear customer consequences, known facts, and update expectations |
| Cracker Barrel | Respond to brand backlash tied to customer identity and loyalty | Show what changed because of feedback instead of only saying the company listened |
| Sonos | Rebuild trust after a product experience failure | Turn the apology into concrete process, product, and governance commitments |
The pattern is simple. Crisis communication works better when the message can point to an action. That action may be publishing verified updates, changing leadership, reversing a decision, changing product processes, supporting affected people, or setting a clear next review point. Without that connection, even good writing starts to feel like reputation management in the narrowest sense.
This is also where PR and leadership have to work together. Communications cannot promise fixes operations will not deliver. Legal cannot reduce every sentence to the point where it says nothing. Executives cannot treat the first statement as the end of the issue. The response has to survive contact with what the organization actually does next.
Tommy Prayoga, Head of Agency at Content Collision, a digital PR service provider:
“During a crisis, the statement is only one part of the response. People are watching whether the company can confirm facts, make a decision, and come back with the next update when it said it would. If the words and the operating response move separately, the credibility gap becomes the story.”
How should PR teams apply the lessons before the next crisis?
PR teams should prepare the decision system before the crisis: ownership, approval routes, stakeholder priorities, holding statements, update channels, spokesperson rules, and the evidence needed to support each message.
A team cannot pre-write every crisis. It can pre-decide how it will think. That is the difference between a useful crisis plan and a folder full of templates.
Use this sequence before the next issue arrives:
- Define escalation triggers. Decide what moves an issue from normal monitoring into a formal crisis response.
- Name the decision owners. Make it clear who verifies facts, who approves language, who speaks, and who can authorize an operational change.
- Map stakeholders in priority order. Employees, customers, affected families, regulators, partners, investors, and media may need different timing and detail.
- Prepare first-response language. A holding statement should acknowledge what is known, avoid speculation, and tell people where the next update will appear.
- Choose the source of truth. Decide whether updates live on a newsroom page, status page, investor page, social account, email channel, or another owned surface.
- Plan the second update before sending the first. Set the next review time, even if the next update is simply that the investigation is continuing.
- Connect every message to an action. If the company says it is listening, show what changed. If it says safety comes first, show the support or operational step behind that claim.
- Run a post-crisis review. Capture where approvals slowed down, which questions were missed, which channels worked, and what needs to change before the next incident.
PRSA's crisis planning guidance makes the same practical point: teams should prepare messaging templates and approval processes before pressure arrives, so the first response can be clear, empathetic, and consistent rather than invented in real time. Its response-framework guidance specifically recommends pre-approved holding statements.
The strongest takeaway from these crisis communication examples is not “respond fast.” It is respond with a system. Move early enough to reduce the information vacuum, stay disciplined about what is verified, show the operational decision behind the message, and make the next update predictable. That is how a crisis response becomes more than damage control.
