A local newspaper reporter picked up the incident from a police report and then two TV news stations did follow-up stories.

A solid plan, Wyss-Schoenborn noted, allows executives to keep up with the rapid pace of an unfolding crisis and, more importantly, to stay in front of the story so that it doesn't lead to bad press, rumors, hearsay and angry, confused or anxious members.

"Philosophically, my best practice is that I want to communicate the credit union's story because it's your story to tell," she said. "When you get in front of that story you control that story. I could have said, 'no, I have no comment,' and who knows where the story would have gone?"

Media relations training helped Wyss-Schoenborn effectively manage the press during the crisis.

She learned to tell reporters that she would be happy to do an interview in collaboration with developing the story. And as part of the collaboration, she asked if the reporter would be willing to give her the opportunity to view the article before it is printed or posted on its news site. The reporter agreed.

"Generally, I improved the story," she said. "I didn't get it 100% accurate, but I did improve it from where it was. They were going on some information that was more hearsay than accurate."

It should be noted, however, that news organizations, including CU Times, have policies prohibiting anyone outside of the news organization to read articles before they are printed or posted on websites.

For example, after Wyss-Schoenborn was interviewed by one of the TV news stations, she did not see the report before it aired. However, she asked the reporter what would be the angle of his story.

"During that dialogue, I redirected him on a couple of talking points to make sure they weren't lost in the story," she said. "For example, that no members suffered a loss and that all members were made whole. I really wanted that out there."

Those messages were reported, which ended the TV news segments on a positive note, according to Wyss-Schoenborn.

From her media training, Wyss-Schoenborn also learned it was important to develop a list of talking points about the crisis and stick to them when questioned by reporters. The talking points were also distributed to employees at the branches and the call center so that they could field questions from members about the ATM skimming event.

The talking points should include the facts about the crisis, what steps the credit union took and what steps the credit union planned to take.

"You really need to be cognizant about how you're presenting and talking to the media because they'll bait you with some questions, but don't bite – stick to your talking points to mold the story and set the direction of the story to be as advantageous to you as possible," she explained.

One TV journalist asked Wyss-Schoenborn how she thought a bank would have handled the ATM skimming theft.

"I said what I can tell you is what we're doing here at Central Willamette, and I constantly went back to my talking points," she said.

In any organization, the crisis communication plan is typically developed by an executive team that will be responsible for implementing the plan.

Casey Boggs, president of LT Public Relations in Portland, Ore., recommended the crisis communications team include only four executives such as the CEO, an HR executive, an IT executive and the chief marketing officer. Having too many people on a crisis communications team may cause confusion.

It's also important to keep your crisis communications plan as simple as possible, which can make it easier for executives to execute in a timely fashion, an important factor when addressing a crisis.

While everyone on the crisis communications team will be responsible for gathering information about the crisis, evaluating it and discussing it, the executive team needs to decide what information they can communicate and to whom.

"A key part of the crisis communications plan is to take an inside-out approach to communicating first to the board, the rest of the executive team, the branch management, the staff and then the members," Boggs said. "You also want to talk to your state association and the NCUA just to let them know what is going on. Then the last piece, although important, is the media."

While there may be legal and compliance issues to also consider, depending on the nature of the crisis, Huey noted, it's important for the credit union to get the information out about the crisis as soon as possible. Effectively communicating about the crisis within the first 24 hours can avoid many problems and may help soften the negative news of the crisis.

"People want to know. That's what good customer service is," Huey explained. "I think there are always ways to say things without getting into compliance or legal issues versus not saying anything at all. Perception is reality. Perception is truth. If you're a member and you find out there was a data breach a month ago, the perception is that the credit union doesn't care about you and all sorts of negative things may surface as well."

Here's an example of a general statement for a data breach crisis: We've had a data breach. We don't know the particulars right now. We want to assure all of our members we're doing everything we can to investigate it and we'll get back to you as soon as we know more.

"That's a generic statement that I don't think any attorney would have a problem with, but I think a lot of organizations just default to not saying anything because of that fear," he said.

While credit unions may see critical and negative comments on their social media sites, it's important for credit unions to address those comments that may have false or misleading information that can feed unfounded rumors.

"I get a lot of questions about social media issues," Huey said. "One of my philosophies is to forget the fear and embrace the opportunities. If you're being attacked on social media and you say nothing, then what positive messages are you getting out? Zero."

Planning ahead, of course, can help address the key legal and compliance issues.

Boggs recommended others who can answer legal, insurance, technology and reputation questions should be involved in the development of the crisis communications plan. For example, the team should answer questions on what the legal and compliance issues are when a data breach or internal fraud occurs; what insurance, technology and reputation implications come with a breach or fraud; and how they affect the crisis communication plan and its implementation.

Boggs also said it's important for executives to discuss different crisis communications scenarios and practice executing the plan through simulations.

Simulations can help everyone understand their roles, practice them and determine whether the plan works and what needs to be improved.

"Crisis management is 99% preparation and 1% execution," Boggs said.

Additionally, after going through a real crisis, it's important for executives to evaluate what went right, what went wrong and what could be done better to be prepared for the next crisis.