Agree who speaks and what is approved
Before anything goes out, decide who approves wording and who is the single source of facts. Agents should never improvise about what was affected.
Say what happened in plain words
Describe what occurred, when, what data was involved and what is not affected. Avoid jargon and avoid guessing.
Tell customers what to do
Give clear steps, such as changing a password or checking an account, and say when they should do it. Action is what people want most.
Prepare replies for the likely questions
Write saved replies for am I affected, what was taken and what are you doing. Update them as the facts become clearer.
Send updates on a schedule
Even when there is little new, say so on a promised date. Silence feels like hiding something.
Review and learn afterwards
Once things settle, check which questions came up most and what was unclear. Improve the next response and the prevention work.