The FBI seized their homepage on Thursday. The stock lost more than 70% by Friday. Alarum Technologies — a Nasdaq-listed Israeli company that traded at fifteen times its price a year ago — is now a sub-$20 million market cap company. Nearly $290 million of shareholder value gone in a single trading session.

Their public response, in full, from outside legal counsel: eighteen words on cooperation.

That is the entire crisis communications strategy of a publicly traded company whose infrastructure was just seized by the Federal Bureau of Investigation.

Let me tell you what should have happened. And what the next Israeli Nasdaq-listed company facing an FBI action is going to have to do — because there will be a next one, and probably a next one after that.

For the sector-level view — the Israeli residential proxy category, the Bright Data / NetNut / IPRoyal map, the enforcement pattern — see the companion analysis on Everything-PR.

The two weeks that mattered were the two weeks before Thursday

The FBI does not show up on a Thursday morning without a runway. Neither does Google Threat Intelligence Group. Neither does the IRS Criminal Investigation division. Coordinated action of that scale is planned in weeks and months — not hours.

The public runway on this one was June 19. Three security firms — Qurium, Synthient, and a third — published technical findings that day linking NetNut's commercial proxy network to a botnet running on two million consumer devices. Brian Krebs picked it up. The story moved from cybersecurity press into general business coverage within days.

That was the two-week window. That was when the company still had control of the narrative, control of the disclosure, control of the sequencing.

Alarum spent that window disputing the research. Their prior public position — "demonstrably inaccurate assertions and flawed deductions" — is what they said before the FBI knocked. It was the wrong position and it was the wrong tone.

Once federal law enforcement is planning coordinated action, the window for denial has already closed. The window that remains is for controlled disclosure, board-level governance response, and shareholder communication. Alarum used none of it.

What eighteen words of legal boilerplate is missing

Read the statement again. "Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account."

Count what is not in there.

No CEO. The statement came from outside legal counsel. Not the founder. Not the chairman. Not the head of investor relations. The most consequential communication in the company's history was routed through a name most shareholders had never heard of.

No shareholders. A publicly traded company lost 71% of its market value. There was no letter to investors. No 8-K commentary beyond the legally required disclosures. No investor call. No plan for continuity of operations. Nothing about what happens Monday.

No customers. NetNut serviced hundreds of commercial buyers — ad verification firms, brand protection vendors, market research operators. None of them heard from Alarum on Thursday. They read Krebs. They read Google. They read TechCrunch. They did not read Alarum.

No governance. No board statement. No independent review committee announced. No commitment to third-party technical audit. No CEO or CTO transition telegraphed. The signal to the market was that leadership was intact and the position was unchanged — which, given what the Google Threat Intelligence Group report said, was the worst possible signal.

No accountability. The phrase "those responsible are held to account" is the tell. Held to account by whom? By Alarum? By the FBI? Are the "responsible" parties inside the company or outside it? The statement is engineered to be readable both ways. Markets read that kind of ambiguity in one direction only.

What the playbook looks like when it is actually run

The crisis communications playbook for a publicly traded company facing federal enforcement action is not a secret. It has three parts.

Part one — the first six hours. CEO on video. Not written. Not through counsel. On video, on the corporate site, on LinkedIn, distributed to every wire service. Acknowledge the action. Confirm cooperation. State clearly what is known and what is not yet known. Announce the board committee. Announce the independent investigation. Set the next update on a calendar.

Part two — the first seventy-two hours. Investor call. Not optional. Every material fact the company knows, in one room, on the record. Analyst Q&A. Continuity of operations statement. Customer notification protocol. Employee communication protocol. All of it in the same forty-eight-hour window, because the story is being written whether the company shows up or not.

Part three — the first thirty days. Governance restructuring, publicly disclosed. Technical audit, publicly commissioned. Product line review, publicly announced. If leadership change is coming, telegraph it early — the market prices the uncertainty worse than it prices the change.

Alarum ran zero of this. They ran the eighteen words. And they lost $290 million.

The lesson for the next one

I have written this before and I will keep writing it. Build the crisis infrastructure before the crisis — not during it.

The Israeli public-company sector is going to see more federal enforcement actions, not fewer. The residential proxy category is one. There will be others — in data collection, in web intelligence, in AI-adjacent categories where the line between commercial product and non-consensual data extraction is thinner than the market has priced.

Every Israeli-founded Nasdaq-listed company operating in one of those categories should have three documents in a drawer right now.

The first document is the six-hour statement. Drafted. Approved by the board. Ready to deploy with a name and a date filled in. Not written by outside counsel at 4 p.m. on a Thursday.

The second document is the seventy-two-hour investor communication package. Talking points. Analyst Q&A. Continuity plan. Customer notification templates. Employee memo. All of it pre-drafted, pre-approved, and version-controlled by someone whose full-time job is to keep it current.

The third document is the thirty-day governance plan. Committee structures. Independent counsel selection. Audit firm relationships. Public disclosure calendar. What good looks like, mapped in advance, so the board is not building it under fire.

The companies that will survive the next wave of enforcement actions are the ones that treat crisis communications as infrastructure, not as a vendor to hire in the third hour.

Alarum treated it as a vendor. Eighteen words. Two hundred and ninety million dollars. That is the math.

Ronn Torossian is the founder and chairman of 5W AI Communications, the AI Communications Firm. He is the publisher of Everything-PR and the author of two best-selling editions of For Immediate Release.