1) Acknowledge a problem in a timely manner (assuming the really did only get escalation one day ago) 2) Provide specific information on what is being done to fix the problem (working w/account holder, making a donation as a mea culpa) 3) Explain limitations on resolution (legitimate constraints on public comment for privacy-protected matter)
What wasn't done well was:
a) letting it get this far to begin with b) failing to explain how future problems will be prevented by policy changes