Five days. That’s how long it took for Mark Zuckerberg to respond publicly after the revelation that Facebook data was used by U.K.-based Cambridge Analytica to aid the Trump campaign. During that time, Facebook stock lost more than $30 billion in value and #deleteFacebook swept other social media platforms.

Did he respond as fast as possible, gathering all the facts and developing a plan? Or did he wait too long? I’m always a fan of a fast response in the face of a crisis, but also of a response that is strategic and made with all the facts. So, look at the Facebook timeline:

On Monday Paul Grewal, deputy general counsel at Facebook, made the first comment, saying in an email that the company is taking action to make sure the data harvested has been deleted: “We are in the process of conducting a comprehensive internal and external review as we work to determine the accuracy of the claims that the Facebook data in question still exists,” he said. “That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people’s information.”

Monday’s news read like this CNBC report: “The future of Facebook as an advertising platform was called into question by marketers, lawmakers and privacy activists on Monday after revelations that its data on 50 million users was harvested and used by Donald Trump’s political ad firm in 2016.” A hashtag also appeared: #WheresZuck, a sign that the world was waiting for the founder to speak.

On Tuesday, Facebook went further in a statement: “Mark, Sheryl and their teams are working around the clock to get all the facts and take the appropriate action moving forward, because they understand the seriousness of this issue. The entire company is outraged we were deceived. We are committed to vigorously enforcing our policies to protect people’s information and will take whatever steps are required to see that this happens.”

Their strategy was clear: to say that they, too, were victims who were violated and they would take strong action. They also promised Mark would speak on Wednesday—by which time #DeleteFacebook was trending, a WhatsApp cofounder had joined the movement and tens of thousands of users had, indeed, deleted Facebook. Plus, governments on both sides of the Atlantic were calling for more regulation.

When Mark finally spoke on Wednesday, putting a long statement on Facebook, he took responsibility and laid out a plan to ensure this doesn’t happen again. But he stopped short of apologizing (which he did later in media interviews).

So, was five days too long to wait for the Facebook response? It seems so. Even if they needed time to gather all the facts and formulate a plan, Zuckerberg could have posted this himself, because it seems his audience only would hear from him, something he should have known. And what was never addressed was why nothing was disclosed about a problem that may have known about since 2015.

Dante Disparte outlines the problem nicely:

The coat of Teflon that usually shields Facebook and its affable leader, Mark Zuckerberg, who has matured into a techno statesman in the public eye, is beginning to wear thin. Facebook now joins a growing number of firms embroiled in a trust deficit with a case of reputation risk whiplash. …Facebook’s eroding market confidence appears to be self-induced by 5 days of silence and lax third-party risk management. Reports of more than 50 million personal records being accessed by Cambridge Analytica… is not only a terrible violation of consumer privacy, it highlights how trust (the new thrift of the modern economy), is hard to earn and easy to lose. (Read more in Disparte’s Wednesday article in Forbes.)

Losing the trust of regulators, business partners and the public—that’s what happens when your response to a crisis is too little, too late.