Why some technology companies recover from security failures while others never regain customer trust.
About twenty years ago, someone working for a database encryption vendor told me about a proof of concept with NTT in Japan.
The vendor had apparently claimed its technology was effectively unbreakable. NTT’s engineers took up the challenge and, according to this employee, cracked it within two weeks. He told me the opportunity was lost and the vendor subsequently disappeared.
I believed the person telling me, but I have never independently verified the account, including what ultimately happened to the company. It remains a story, not an established case study.
What stayed with me was the commercial question. If customers stop believing the promise at the centre of your business, what exactly have you left to sell?
After more than twenty years working with technology leaders in Japan, I think that question deserves more attention than the familiar discussion about incident response. Restoring systems and restoring a customer’s willingness to buy are different jobs.
The current cases: consequences, not predictions
Fireworks AI’s 9 November 2026 update describes a widening investigation: account and billing information, and, for certain customers, secrets, datasets and incomplete model weights were affected. It also describes further access through a third-party cloud provider to development machines in October. Fireworks says it has not detected impact to its Inference, Training SDK and Nexus services, which are zero data retention by default.
There is already a concrete customer consequence. Notion says it disconnected from Fireworks by 3 November. Subsequent investigation identified Notion AI chat transcripts used for its Insights feature in the affected data, involving fewer than 1% of workspaces. Notion disabled Insights and stopped serving open-weight models through Fireworks.
That establishes a disrupted customer relationship. It does not establish Fireworks’ revenue loss, wider customer departures or long-term fate.
In Japan, GMO Internet identified 26,739 potentially affected servers in its Onamae.com Desktop Cloud incident. That is the potential scope, not a confirmed count of compromised servers. Information stored on those servers, including trading-account credentials, could have been obtained and misused. GMO stopped servers, investigated with security specialists and urged customers to change credentials.
Business+IT’s report of the November press conference says a vulnerability warning from 2024 had not reached group chairman Masatoshi Kumagai. That raises an escalation and governance question, without establishing that one warning alone explains the attack.
GMO’s 6 November disclosure says individual contact over compensation had begun, but the compensation amount could not yet be calculated. The financial burden and longer-term customer response remain unresolved. Neither current case supports a confident prediction of permanent decline.
When the failure removes the business itself
DigiNotar is a much clearer example of existential damage. Its certificate authority depended on other organisations accepting its assurances. Following the 2011 compromise, Mozilla removed that trust, citing failures to notify, uncertainty about the breach’s scope and inadequate containment. Its parent’s SEC filing records DigiNotar’s bankruptcy on 20 September 2011.
The failure reached beyond reputation: a critical dependency of the product’s usefulness was withdrawn.
Code Spaces illustrates another limit. Its 2014 closure announcement, reproduced by Ars Technica, described an attacker deleting data and backups after gaining access to its AWS control panel. The company wound down. Leadership could not communicate its way around the destruction of the assets required to serve customers.
These are reminders that severity and architecture matter. Trust cannot compensate for a business that no longer has a viable service.
Growth does not mean the damage disappeared
Okta offers a more complicated picture. After the January 2022 incident involving a support provider, management acknowledged shortcomings in communication and said its leadership had met thousands of customers. Following the 2023 support-system compromise, it provided customer impact reports and changed access and retention controls.
Its July 2026 SEC filing still says the incidents harmed reputation and customer relations and adversely affected financial results. It separately discusses longer sales cycles; that does not make every delayed deal breach-related.
Yet annual revenue rose from $2.263 billion in fiscal 2024 to $2.610 billion in 2025 and $2.919 billion in 2026. Growth and damage are both documented. The missing number is what the business would have achieved without those incidents.
CrowdStrike is an instructive comparison, with an essential distinction: July 2024 was a faulty software update and outage, not a cybersecurity breach. Its July 2026 filing describes high gross retention alongside delayed purchasing decisions, longer sales cycles and concessions to customers.
At roughly twelve and twenty-four months after the outage, quarterly revenue was $1.17 billion and $1.47 billion respectively, according to its second-quarter fiscal 2027 results. Continued growth is clear. Complete commercial recovery is a much stronger claim. A thirty-six-month comparison is not yet possible.
SolarWinds also survived its 2020 SUNBURST supply-chain compromise. Its 2024 annual filing shows revenue of $719.4 million in 2022, $758.7 million in 2023 and $796.9 million in 2024. Those results demonstrate a continuing business, not proof that every relationship recovered. The N-able separation and transition towards subscriptions also complicate simple before-and-after comparisons.
Progress Software shows how long the financial consequences can persist. More than three years after the 2023 MOVEit attacks, its August 2026 filing reports continuing litigation, $6.1 million in incident-related costs net of insurance for nine months, and exhausted cyber insurance coverage. Possible further losses could not be reasonably estimated. Meanwhile, its 2024 results showed growing operating cash flow and an expanding portfolio. Group performance cannot be treated as a measure of confidence in one product.
LastPass is a useful boundary on what we can conclude. Its incident update confirms theft of customer vault backups, with sensitive vault contents encrypted but certain information, including URLs, unencrypted. That directly challenges the confidence customers need in a password manager. Without reliable comparable customer and revenue disclosures, however, reputational criticism cannot honestly be converted into a quantified commercial decline.
Japan’s recovery is owned locally, even when the failure is not
I know an executive who runs the Japanese business of a global technology vendor that experienced a serious incident involving Japanese customer data. According to him, the incident was not publicly disclosed. He told me confidence took several years to rebuild, and the business still had not regained its previous commercial position.
This is an anonymised personal account, not an independently verified public case. I will not identify the company.
It points to a practical problem for Country Managers. Headquarters may control the investigation and approved statements. The local executive must face the buyer who recommended the product, the security team reviewing it and the procurement team deciding whether renewal is defensible.
My advice is to treat those as separate relationships requiring evidence. What changed? Who verified it? What can the customer show its own management? When will the next update arrive? A translated global statement is only a starting point.
Competitors have an opening whenever those answers remain weak. They do not need to prove their technology is perfect; they need to make changing suppliers seem less risky than staying.
What leadership must rebuild
Switching costs can buy time. A broad portfolio and financial reserves can fund remediation and concessions. Neither should be mistaken for renewed confidence. A customer may renew while reducing future commitments.
Boards should therefore track more than churn: delayed approvals, discounting, expansion, procurement objections and whether customers will still act as references. Ask the Country Manager which relationships have recovered, what evidence supports that judgement, and what authority or resources are still missing.
The importance of backing local leadership also runs through our Recorded Future Japan case study. After a failure, that backing must extend to difficult customer conversations and commitments headquarters is prepared to honour.
The severity of an incident can determine whether survival is possible. Where it remains possible, leadership’s response, customers’ judgement of that response and the patient rebuilding of trust may matter just as much.
The technical team can tell you when the breach is contained. Only customers can tell you when the business has recovered.
By Murray Clarke, Founding Partner and CEO, Aspiring Partners. Public-source information checked as of 12 November 2026. Personal accounts are explicitly identified above.
