"When Dropbox suffered a cyber attack in 2012, I read that the hack was due to a Dropbox employee using the same password between corporate Dropbox accounts and a personal LinkedIn account. First, I would announce that practice to be against policy, which would result in termination. Second, I believe it's important to put out the media fire as soon as possible. News of a hack will get out, one way or another, so it's better if the company that suffered the attack is the first to announce, with a plan already in place. Next, I would ensure that each customer was contacted via an urgently placed email, prompting them to change their passwords. Overall, the most important action is to own the incident and be public about the changes you are making as a company to avoid the situation from repeating itself."