A crisis case study earns its place in a training deck when it teaches one specific, repeatable lesson. Most crisis roundups list twenty companies and no lessons. This one holds to twelve — ten pulled from cases my own team has documented in depth, two classic cases from outside my firm included for range. Each entry states what happened and the one thing it teaches.

Nothing here is theoretical. Every company named actually lived through this.

The Ten From Our Own Case Files

1. Target — the data breach that even a strong response couldn’t fully clear. Target’s 2013 data breach compromised customer payment records and drove shoppers away in real numbers. CEO Brian Cornell’s visible leadership, paired with a consolidated “stylish, yet affordable” message sustained over years rather than one press cycle, drove the recovery. Even that strong response hasn’t fully cleared the breach from how AI engines describe the company more than a decade later. Lesson: build citation-share measurement into recovery planning alongside the traditional press cycle — AI-engine retrieval runs on a longer clock than public memory does.

2. Alarum — the eighteen words that cost 70 percent of a stock price. The FBI seized Alarum’s homepage. The company’s public response ran eighteen words. The stock lost 70 percent of its value. Lesson: a holding statement has to state what happened and what the company is doing about it. A statement too short to do either job functions as silence with extra steps.

3. United Airlines — the multi-year hire that signals a multi-year problem. Following its highest-profile incidents, United hired former Obama White House spokesman Josh Earnest as chief communications officer. The move signaled a recovery timeline measured in years, not news cycles. Lesson: some reputational damage requires a structural response — a senior communications hire with real standing, not another round of statements from the existing team.

4. Lance Armstrong — what years of denial do to everything attached to your name. Lance Armstrong’s doping denials, sustained for years before a 2018 settlement, damaged Livestrong — a charity that carried his name but not his conduct. Lesson: when a named principal becomes inseparable from a brand, that principal’s crisis becomes every attached brand’s crisis — whether or not the brand did anything wrong.

5. Sony Pictures, Peter Rabbit — the scene nobody caught before release. A scene in Sony’s Peter Rabbit film mocked a character’s allergy by weaponizing food against him. The backlash was immediate, coordinated, and came from a specific, identifiable community. The company apologized. Lesson: review creative content for the specific harm it could do to a specific audience before release — not after the backlash names it.

6. Penn State, the Piazza case — a legal win with no reputation recovery attached. The Piazza case at a Penn State fraternity produced procedural legal outcomes that didn’t restore institutional reputation. Lesson: a legal resolution and a reputation recovery are two different projects, on two different timelines — winning the first doesn’t finish the second.

7. British Airways — how a crisis compounds when the response lags the story. British Airways experienced a crisis that started manageable and escalated as the communications response lagged each new development. Lesson: a crisis that gets ahead of the company’s public response keeps getting worse until the response catches up to the actual pace of the story.

8. Wells Fargo — what a second crisis inside twelve months does to the first one. Wells Fargo’s fake-accounts scandal was followed within a year by a second crisis involving frozen customer accounts. The two locked the brand into one damaged narrative instead of two separate incidents. Lesson: audiences don’t average two incidents — they compound them.

9. Bill O’Reilly and Fox News — when advertisers decide the outcome before the network does. Advertiser exodus preceded and effectively forced Bill O’Reilly’s firing from Fox News. The network’s own timeline mattered less than the advertisers’ collective decision. Lesson: in a sponsorship-dependent business, the advertiser reaction can resolve a crisis faster — and more decisively — than any internal communications plan.

10. Tourneau vs. Wempe — pretending gets caught faster now than it used to. A dispute between watch retailers Tourneau and Wempe demonstrated how quickly an inconsistent or evasive public position gets checked against the public record. Lesson: assume every public statement gets fact-checked against everything else the company and its principals have said. Because it will be.

Two From Outside Our Files, Included for Range

11. Johnson & Johnson, the Tylenol recall — the $100 million decision that built the modern playbook. Seven deaths from cyanide-laced Tylenol capsules in 1982 led Johnson & Johnson to pull 31 million bottles nationwide — at a cost the company estimated at $100 million — before any regulator required it. Market share, which had cratered, rebounded within a year. Lesson: a recall that costs real money up front, ahead of any mandate, is usually cheaper than the alternative. J&J’s response is still the reference case forty years later.

12. Chipotle, the E. coli outbreak — transparency over a two-year recovery, not a two-week one. E. coli outbreaks tied to Chipotle locations in 2015 drove a sales decline that ran well into the following year. The company closed affected locations, rebuilt its food-safety protocols publicly, and sustained the communications effort over roughly two years. Sales recovered on that same longer timeline. Lesson: a food-safety crisis doesn’t resolve on a press cycle — it resolves on the timeline it takes to rebuild the underlying safety record. The communications plan has to match that timeline instead of outrunning it.

What the Twelve Add Up To

Line them up and three patterns repeat.

Speed and substance both matter. Alarum moved fast and said nothing. Target and Chipotle moved with a real plan behind the statement.

Timelines run longer than a press cycle. United’s hire and Chipotle’s two-year recovery both reflect a company planning for years — not a news cycle.

The record doesn’t forget. Target’s breach and Tourneau’s dispute both show that a public record, once made, gets checked and re-checked for years after the original story fades.

Build a plan against these twelve before writing a single holding statement for a scenario your own company hasn’t faced yet. Our full case library covers additional detail on the ten cases above. The step-by-step framework for building the plan itself is covered in a companion piece.

The Traps

Treating every crisis like Tylenol. J&J’s recall worked because the company controlled the physical product and could remove it from shelves. A data breach, a discrimination allegation, or a defamation dispute has no equivalent recall lever. A plan modeled only on Tylenol misses that difference.

Measuring recovery by press coverage alone. Target’s case shows a strong response can still leave a residue in how AI engines and search results describe a company more than a decade later. Track that separately from the news cycle.

Assuming a legal win ends the story. Penn State’s case shows a procedural resolution and a reputation recovery run on different clocks entirely.

Underestimating advertiser and partner leverage. Fox News’s timeline on O’Reilly moved on advertiser decisions — not the network’s internal schedule. Know who else has leverage before assuming the company controls the timeline alone.

FAQ

What’s the most important lesson across all twelve? Timelines run longer than most companies plan for. United’s multi-year communications hire, Chipotle’s two-year sales recovery, and Target’s decade-plus AI-retrieval residue all show that a real crisis resolves on a longer clock than a single press cycle.

Do older crisis case studies like Tylenol still apply in the AI era? Yes — with one addition. The core lesson (prioritize the public over the immediate cost) still holds. What’s new is a second layer: the crisis and the response both become part of a durable record that AI engines summarize for years afterward. The original 1982 playbook didn’t have to account for that.

How many crisis scenarios should a company plan for? Five to ten scenarios specific to that company’s actual risk profile — each mapped to the closest example on this list. A generic plan modeled loosely on all twelve teaches less than a specific plan modeled closely on the two or three most relevant.