For Immediate Release: Shape Minds, Build Brands, and Deliver Results with Game-Changing Public Relations (2015)

---

Leaving the Phoenix war room, I see the room across the hallway where Ann and her team handle problem orders. I’m overcome by a sudden curiosity, genuinely wanting to see how they’re doing.

I knock and walk in, still chewing a stale bagel from the meeting. Since Saturday, there has been an endless supply of pizzas, pastries, Jolt colas, and coffee to keep all the troops at their tasks.

Before me is a scene of frenetic activity: There are tables covered with piles of incoming faxes from the stores and twelve people walk from one to the next. Each fax is a problem order waiting to be routed to an army of finance and customer service representatives who have been press-ganged into service. Their job was to either deduplicate or reverse every one of these transactions.

In front of me, four finance people are sitting at another table, their fingers flying across ten-key calculators and open laptops. They’re manually tabulating the orders, trying to calculate the scale of the disaster and doing reconciliations to catch any mistakes.

On the wall, they’re keeping track of the totals. So far, five thousand customers have had either duplicate payments or missing orders, and there are an estimated twenty-five thousand more transactions that still need to be investigated.

I shake my head in disbelief. Steve is right. We massively screwed the customers this time. It’s downright embarrassing.

On the other hand, I have to respect the operation the Finance people have put in place to handle the mess. It looks organized, with people doing what needs to get done.

A voice next to me says, “Another Phoenix trainwreck, huh?”

It’s John, taking in the scene like me. He’s not saying “I told you so,” but almost. With him, of course, is his ever-present black three-ring binder.

John smacks his face with his palm. “If this were happening to our competitor, I’d be laughing my ass off. I told Chris over and over about this possibility, but he wouldn’t listen. We’re paying for it now.”

He walks up to one of the tables and starts looking over people’s shoulders. I see his body suddenly tense as he picks a pile of papers up. He flips through the papers, his face ashen.

He returns to where I’m standing, and whispers, “Bill, we’ve got a major problem. Outside. Now.”

“Look at this order slip,” he hisses as we stand outside. “Do you see the problem here?”

I look at the page. It’s a scanned order slip, slanted and low-resolution. It’s for a purchase of various auto parts, and the dollar amount seems reasonable at $53.

I say, “Why don’t you just tell me?”

John points to a handwritten number scrawled by the scanned credit card and customer signature. “That three-digit number is the CVV2 code on the back of the credit card. That’s there to prevent credit card fraud. Under the Payment Card Industry rules, we are not allowed to store or transmit anything on track 2 of the magnetic card stripe. Even possessing this is an automatic cardholder data breach and an automatic fine. Maybe even front-page news.”

Oh, no. Not again.

He continues, as if reading my mind, “Yeah, but worse this time. Instead of just being on the local news, imagine Steve being splashed on the front page of every market where we have customers and stores. And then flying to DC to be grilled by senators, on behalf of all their outraged constituents.”

He continues, “This is really serious. Bill, we’ve got to destroy all of this information immediately.”

I shake my head, saying, “No way. We’ve got to process every one of those orders, so that we don’t charge or even double-charge our customers. We’re obligated to do this, otherwise we’re taking money from them that we’ll eventually need to return.”

John puts his hand on my shoulder, “That may seem important, but that’s only the tip of the iceberg. We’re already in deep shit because Phoenix leaked cardholder data. This may be just as bad. We get fined according to the number of cardholders affected.”

He gestures at all the papers, saying, “This could more than double our fines. And you think our audits are bad now? This will make them ten times more painful, because they’ll classify us as a Level 1 merchant for the rest of eternity. They may even raise our transaction fees from three percent to—who knows how high? That could halve our retail store profit margins and—”

He stops mid-sentence and opens up his three-ring binder to a calendar. “Oh, shit! The PCI auditors are on-site today doing a business process walk-through. They’re on the second floor, interviewing the order administration staff about our operations. They’re even supposed to use this conference room!”

“You’ve got to be kidding me,” I say as the feeling of panic starts to set in, which amazes me considering that it’s been three days of constant adrenaline.

I turn to look through the window of the conference door and see very clearly all the finance people handling all the customer problem orders. Shit.

“Look,” I say, “I know that sometimes people think you’re not on our side, but I really need your help. You’ve got to keep the auditors off this floor. Maybe even out of this building. I’ll put up some curtains on the windows, or maybe even barricade the door.”

John looks at me and then nods. “Okay, I’ll handle the auditors. But I still don’t think you fully understand. As the custodians of cardholder data, we cannot allow hundreds of people to have access to it. The risk of theft and fraud is too high. We’ve got to destroy the data immediately.”

I can’t help but laugh for a moment at the endless stream of problems.

Forcing myself to focus, I say slowly, “Okay, I’ll make sure the Finance people understand this and handle it. Maybe we can get them all scanned and shipped to an offshore firm for them to enter.”

“No, no, no. That’s even worse!” he says. “Remember, we’re not allowed to transmit it, let alone send it to a third party. Understand? Look, just so we can claim plausible deniability, I’m going to pretend I didn’t hear that just now. You’ve got to figure out how to destroy all this prohibited data!”

I get pissed off at John’s mention of plausible deniability, regardless of whether it was well intentioned or not. I take a deep breath and say to him, “Keep those auditors off this floor, and I’ll worry about the card imprints. Okay?”

He nods and says, “Roger. I’ll call you when I park the auditors somewhere safe.”

As I watch him walk quickly down the hallway to the stairway, I keep thinking to myself, “He’s only doing his job. He’s only doing his job.”

I swear under my breath and turn back around to look back at the conference room. And now I see the big printed sign hanging on the door, proclaiming “Phoenix POS Recovery War Room.”

Suddenly, I feel like I’m in the movie Weekend at Bernie’s, where some teenage boys keep trying to hide or disguise a dead body from a hit man. Then I wonder if this is more like the massive around-the-clock shredding operation that allegedly happened at the offices of Arthur Andersen, the audit firm investigated after Enron failed. Am I complicit in destroying important evidence?

What a mess. I shake my head, and walk back into the conference room to deliver the bad news.