The first rule in a crisis is that nobody speaks except the single spokesperson designated in advance. The first response to the press should be limited to the verifiable minimum, avoiding details that have not yet been confirmed, avoiding speculation, and avoiding any wording that could amount to accepting responsibility.
A statement made early and without control can be read against you in a continuing investigation, and it can create the risk of an admission in any later legal dispute. Rather than “no comment”, prefer a form of words that commits to nothing while making clear that you are taking the situation seriously and are looking into it. The text should be prepared by the communications team and the lawyers together, confining the facts to those that have been confirmed and screening out the risk of admissions. Internal and external communications need to say the same thing, and any notification duties — to the regulator, to the individuals concerned — must not be overlooked while this is going on.
Shall we apply this matter to your situation?
Tell us your specific situation in a few sentences; we'll assess it with the right team.