What to actually say
Open with this, more or less word for word: You're right, we got this wrong, and I'm not going to make excuses for it.
You're right to be angry about this — we made a mistake, not you.
Naming the mistake as yours in the first sentence removes the thing most angry customers are braced to fight for.
Here's exactly what happened on our end, no spin.
People who've been wronged usually want information more than comfort, and specifics read as honesty in a way apologies alone don't.
I can't promise you it'll never happen again, but here's what I can do right now.
Drawing the line before they demand the impossible thing keeps you from either lying or backing yourself into a corner later.
I'll find out if this is a pattern and tell you straight either way.
This commits to a fact-finding step you actually control instead of a reassurance you'd be inventing on the spot.
How it usually goes
A version of the conversation with the push-back left in, because that is the part you need to have already heard once.
What not to say
I'm so sorry, I'm so, so sorry.
Stacked apologies center your discomfort, not their problem, and often read as performance which makes angry people angrier.
I understand exactly how you feel.
It sounds rehearsed and hands them a free line back at you: no, you don't.
This isn't normally how we do things here.
You're inventing a claim about company behavior you can't verify, and if they've had trouble before it collapses instantly.
If they demand a guarantee this will never happen again
Don't give it to them, and don't dodge either. You can't promise perfection, but you can promise honesty about what's changing. Say: 'I can't promise this exact thing won't happen again — I can tell you what we're doing about it, and if you check back, I'll tell you straight where it stands.' An empty guarantee feels good for ten seconds and costs you everything the next time something goes wrong. A named limit, held to, is what actually gets believed over time.