## 5 Discussion
As supported by recent studies [48] employee social identity and perceived procedural justice play a key role in shaping the selection of image restoration strategies after data breaches. This enriches current theories by foregrounding the active negotiated nature of internal crisis communication in the wake of data breaches. Our findings also suggest that employees' social identity, particularly their level of identification with the organisation, strongly influences which image restoration strategies they adopt. Employees with strong organisational identification tend to engage in corrective action or reducing offensiveness, while those with weaker identification or critical stance are more likely to adopt denial or distancing strategies. While many technical frameworks (such as ISO 27001 or NIST CSF) address organisational security, relatively little attention has been paid to how employee agency shapes knowledge governance in the sensitive post-breach phase, an area this study seeks to advance. Knowledge management (KM) plays a pivotal role in shaping employee responses and organisational resilience following data breach incidents. In organisations affected by cyberattacks involving data leaks, robust KM practices can mitigate uncertainty by facilitating transparent communication, knowledge sharing, and the dissemination of security protocols. These mechanisms not only support employees in regaining confidence but also influence how they perceive the organisation's reputation post-incident. When knowledge flows effectively, employees are more likely to align with the company's recovery narrative, potentially buffering reputational damage internally and externally. Furthermore, the perception of organisational competence in managing knowledge post-breach correlates with higher levels of employee trust and engagement. Therefore, the strategic deployment of KM systems post-cyberattack is not merely operational but reputational. Empirical studies underscore the mediating role of KM in employee attitudes and corporate image restoration following cybersecurity incidents [49]. As practical implications, organisations should actively integrate employee perspectives into post-breach information governance, for example by establishing structured channels for employee input and feedback on data protection practices. Additionally, companies should encourage cross-level dialogue on data security, allowing frontline employees and managers to co-create response protocols that reflect both organisational priorities and employee concerns. The reputational impact on organisations following cyberattacks involving data breaches is both profound and multifaceted, often extending beyond external stakeholder perceptions to significantly affect internal employee dynamics. Empirical evidence suggests that such incidents can erode trust, diminish organisational commitment, and foster a climate of uncertainty among employees, particularly when communication is perceived as insufficient or reactive rather than strategic. From a reputational standpoint, data breaches frequently lead to public scrutiny, loss of consumer confidence, and potential financial repercussions, all of which are compounded when internal actors--employees--perceive mismanagement or lack of preparedness. Effective knowledge management and transparent crisis communication have been shown to play a critical role in mitigating these effects, helping to restore both employee morale and the organisation's external image. Thus, the reputational and employee-related consequences of cyberattacks are closely interlinked, necessitating integrated response strategies that address both human and reputational dimensions [50]. By operationalising employee involvement, through participatory design of data policies, inclusive crisis communication strategies, and transparent post-incident reviews, organisations can foster greater trust, resilience, and authenticity in their cybersecurity governance.