AI search brings up old data breaches when customers ask if they can trust you, like a mate who still mentions that one barbecue
By Brett Gavaghan, Founder of Adaptd ·
Australian research found AI answers mentioned a company's past data breach 42.2% of the time when people asked whether that brand could be trusted, even years after the incident.
The short version
- Australian agency Sefiani found AI search tools often mention a company's past data breach when people ask whether that brand can be trusted.
- Breach history appeared in 42.2% of brand trust answers, compared with 2.7% of broad category searches, across ChatGPT and Google's AI answers.
- If you've had an incident, publish a clear account of what happened and what you changed on your own website.
Most businesses hope a data breach fades from memory once it's fixed. AI search has a better memory than most of your customers.
What did the research find?
Sefiani, an Australian communications agency that's part of Clarity Global, found that AI search tools bring up a company's old data breaches far more often when someone asks whether that specific brand can be trusted. The research was published on 14 October 2026.
Breach history showed up in 2.7% of AI answers when people researched a category broadly, and in 42.2% when they asked about a specific brand. For one of the three organisations in the research it reached 59.1%, and all three incidents had been resolved years earlier. Sefiani tested about 30 prompts per brand across ChatGPT and Google's AI answers, and surveyed 1,019 Australian adults through YouGov.
Why does it matter for your business?
AI answers about a business lean heavily on that business's own website: company content appeared in almost 90% of responses, compared with about 60% for media coverage. If your site says nothing about an old incident, the AI fills the gap with old news stories and commentary.
Customers also forgive more than they say. A third of Australians said they'd stop buying from a breached business, but only about one in 10 former customers of one actually did. The top reason people stayed, at 39%, was what the company did to stop it happening again.
What should your business do about it?
Businesses that have had a breach should publish a short, factual account on their own website covering what happened, what they did and what they changed.
My advice: ask ChatGPT and Google whether your business can be trusted, and read the answer the way a new customer would. If an old incident comes up, your version needs to be on your own site, in plain words. If you've never had one, write down who would say what if you did. Nobody enjoys a fire drill, but everyone's glad they know where the stairs are.
Wondering what this means for your business?
That's exactly what the discovery call is for.