The First 24 Hours of an Online Reputation Crisis

A reputation crisis rarely announces itself politely. It shows up as a colleague's message asking "have you seen this," a customer email quoting something you never said, or a founder's phone buzzing with the same link from three people at once. By the time most organizations notice a crisis, it is already moving, and what happens in the next 24 hours often matters more than what happens in the following month.

This is not a guide to one type of incident. A reputation crisis can start with a deepfake video, a viral customer complaint, a data breach disclosure, a former employee's public allegations, a journalist's inquiry, or a single screenshot taken out of context. What they share is a compressed timeline: decisions normally made with legal review and stakeholder sign-off suddenly need to happen in hours. Eterna's executive first-hour playbook covers the narrower case of the first 60 minutes after a leader discovers a deepfake or impersonation attack. This article is broader: it covers the full first day of any online reputation crisis, for individuals and organizations alike, and the decisions that tend to shape how the following weeks go.

Hour 0 to 1: Confirm before you react

The instinct in a crisis is to respond immediately. The more useful instinct is to confirm quickly, then respond deliberately. In the first hour:

• Verify what you're looking at. Is the content real, altered, fabricated, or genuine but missing context? Treating a manipulated image as authentic, or a real complaint as fabricated, sends the response down the wrong path immediately.
• Establish scope. Is this one post on one platform, or is it spreading across several? Is it being picked up by an aggregator, a forum, or a journalist? Scope determines urgency.
• Identify who needs to know right now. For a business, this is typically a small group: a communications lead, legal counsel, and the relevant executive. For an individual, it may be a manager, a trusted colleague, or family. Resist the urge to loop in everyone before you understand what you're dealing with.
• Do not respond publicly yet. A rushed reply, correction, or denial posted before the facts are confirmed is difficult to walk back. Silence for the first hour is rarely costly; a wrong public statement usually is.

Hour 1 to 4: Document and assess

Once the situation is confirmed, the priority shifts to building an accurate picture before deciding how to respond.

• Preserve evidence. Capture full-page screenshots with visible URLs and timestamps, save original files, and log what you've found and when. Eterna's verification methodology covers this in more depth for deepfake-specific cases, and the same principles apply to any online crisis: document before content can be edited, deleted, or reposted elsewhere.
• Assess who has seen it. Check view counts, share counts, and comment volume where visible. Search for the content or key phrases from it across other platforms to see whether it has already spread beyond its original post.
• Identify the likely audience. Is this circulating among customers, employees, investors, a professional community, or a personal network? The audience shapes both the tone and the channel of any eventual response.
• Loop in the right specialists. Depending on the nature of the incident, this may include legal counsel (for defamatory or fraudulent content), a platform-trust-and-safety contact, a communications or PR advisor, or, for content involving explicit or exploitative material, law enforcement. Eterna's role at this stage is to help monitor, verify, and document; decisions about legal action or public statements sit with the organization's own counsel and leadership.

Hour 4 to 12: Decide whether, and how, to respond publicly

Not every incident requires a public statement. Some are best addressed through direct platform reporting and quiet monitoring; others genuinely require the organization or individual to say something. A few questions help clarify which situation you're in:

• Is the content demonstrably false, and can that be shown clearly? If so, a factual, measured correction, without amplifying the original content further, is often appropriate.
• Is there real harm to customers, users, or the public that requires a response regardless of fault? A data exposure or safety issue may call for transparency even before every fact is confirmed, because stakeholders need to know what to do.
• Would responding publicly draw more attention to content that is otherwise fading? Sometimes the most effective response is continued platform reporting and monitoring rather than a public statement that gives a small incident a larger audience.

If a public response is warranted, it typically works best when it is factual rather than defensive, specific rather than vague, and focused on what is being done rather than only on what was said about you. Statements that read as legal boilerplate or that attack the source of the original content tend to extend the story rather than close it.

The choice to respond publicly is not reversible in the way silence is. Once a statement is made, it becomes part of the record and part of what people search for afterward , which is one reason it's worth a few hours of assessment before deciding.

Hour 12 to 24: Begin the removal and monitoring process

In parallel with any communications decisions, the practical work of addressing the content itself should be underway:

• File platform reports through the correct channels for the type of content involved (impersonation, harassment, non-consensual content, defamation, copyright). Eterna's impersonation response guide walks through platform-specific reporting paths for identity-related content.
• Track where the content has spread, not just its original post, since a single removal rarely addresses every copy. Eterna's deepfake reupload guide explains why content that looks removed can resurface elsewhere.
• Begin search-visibility monitoring so you know whether the content is affecting what appears when people search your name or your company's name, not only whether the original post is still live.
• Set expectations internally about timeline. Platform reviews can take hours to weeks depending on the platform and the type of report. A crisis that is well-managed in the first 24 hours can still take much longer to fully resolve, the first day is about establishing control and direction, not necessarily reaching a conclusion.

What the first 24 hours should produce

By the end of the first day, the goal is not that the problem is solved, for most reputation incidents, it isn't yet. The goal is that you have: a confirmed and documented understanding of what happened, the right people informed, evidence preserved, reports filed with the relevant platforms, a decision made (and, if applicable, executed) about public communication, and monitoring in place to track how the situation develops. Organizations that reach hour 24 with those five things in place are typically in a far stronger position over the following weeks than those still trying to establish basic facts.