The crisis response that cost Peloton $19M
Hey Everyone,
In April 2021, the US Consumer Product Safety Commission published an urgent warning telling people to stop using Peloton's Tread+ treadmill after one child died and dozens more were injured.
Peloton answered the same day. The company called the warning "inaccurate and misleading" and told customers there was no reason to stop using the machine. Days later, Peloton recalled 125,000 treadmills, and CEO John Foley admitted: "Peloton made a mistake in our initial response." In 2023, regulators added a $19 million penalty for the delays.
Peloton's first response was fast, and that was never the problem. The problem was reaching a conclusion before the facts supported one.
Today we're walking you through what to do in the first two hours of a public crisis, even if you have no official comms team.
The first two hours, step by step
Minutes 0–15: Get the smallest group that covers three things on a call
- The person closest to what happened
- Someone who understands the legal exposure
- Someone who can write
One of them keeps a running doc with three headings: one for what's confirmed, one for what's not confirmed yet, and one for what's already public, and they keep it updated for as long as the crisis runs.
Wrong statements come from mixing those columns, so this doc becomes the only source anyone writes from.
Minutes 15–30: Make your first call based on the type of damage
- Someone was hurt, or data was exposed → call a lawyer before you say anything
- The damage is to your reputation (a viral post, a bad story about to run) → call the most experienced communications person you can reach
- The crisis involves you personally → call your board chair before any statement goes out, because they should never learn about it from the press
If you have a coach or a fellow CEO who's been through a crisis, call them next. They won't write your statement for you, but a few minutes with someone who's calm and has no stake in the outcome will improve every decision that follows.
Minutes 30–60: Write a holding statement of about 100 words
This is your first public message, and its job is to buy time by showing you're on it. Fill in the skeleton below.
"We're aware of [what happened, in one plain sentence]. Our first concern is [the people affected]. We're [the specific thing you're doing right now]. We'll share updates at [channel], and the next one will come by [a time you can meet]."
The statement says nothing about what caused the problem, who is at fault, or how it will end, because you don't know yet. If a sentence starts with "we believe" or "we're confident", cut it.
Minutes 60–90: Tell your team before you tell the public
They'll hear about it within minutes anyway, and they'd rather hear it from you. They're also the people you'll need to fix the problem. The message below is all you need for now:
"Team, [one sentence on what happened]. Our first priority is [the people affected], and we're [the specific thing you're doing right now]. [Name] is the only person who speaks for the company on this. If a reporter or customer contacts you about it, please don't respond on the company's behalf — forward it to [name]. Updates will come in this channel."
Minutes 90–120: Publish the holding statement where the conversation is happening
If the story is spreading on X or LinkedIn, post it there. If customers are affected, email them directly. If a reporter called, the statement is your reply. Then meet the update time you promised, even if the update is "we're still investigating."
From there, the job is repetition. You update on schedule, add facts as they're confirmed, and save the full explanation and any apology for when you know enough to stand behind them.
Shouldn't we respond faster than that?
Acknowledge as early as you can. CrowdStrike kept 98% of its customers through the worst outage in its history, and the response explains why.
When a faulty update crashed 8.5 million Windows computers in July 2024, the company withdrew it within 78 minutes, and CEO George Kurtz posted publicly the same morning, apologized in an open letter that day, and kept recovery instructions updated until systems were back.
What CrowdStrike never speculated on was the cause. Every update covered what was confirmed and what to do about it. Speed on acknowledgment builds trust. Speed on conclusions, the mistake Peloton made, is what you pay for later.
Try this today
Fill in the crisis sheet this week, while you can think clearly. It takes about 30 minutes, most of it looking up phone numbers, and if a crisis hits, every decision on the sheet is already made.
The crisis sheet is like insurance – we hope you never need it, and you'll be very glad it exists if you do.
Go deeper
👉 CrowdStrike: To Our Customers and Partners — read the actual letter Kurtz published on the day of the outage, and notice how much it commits to without speculating once.
👉 PRSA: 5 Steps for Navigating the First Hour of a Crisis — use this to pressure-test your own first-hour plan against what professional crisis communicators do.
👉 Risk Management Magazine: Key Lessons From Peloton's Tread+ Recall — worth ten minutes if you sell a physical product, because it shows how regulators respond when a company digs in.
👉 Deloitte: Confidence Exceeds Crisis Preparedness — send this to whoever would push back on spending 30 minutes on the crisis sheet.
Coming up tomorrow
Tomorrow, we'll walk you through the fire-or-fix audit, including the three options to offer a customer before you end the contract.
See you tomorrow!