Managing and mitigating tech and cybersecurity risks in M&A deals

As M&A deals become increasingly reliant on technology, the digital side of dealmaking becomes ever more sophisticated as it increases the efficiency of M&A transactions. However, the flip side is that any tech-related incidents or cybersecurity breaches have the potential for more devastating consequences for deals than ever before.

A survey conducted by Deloitte in October 2020 found that 51 per cent of respondents considered cybersecurity threats to be their top concern when managing M&A deals virtually. Meanwhile, 52 per cent of global dealmakers recently polled by MergerMarket said that the increasing importance of cybersecurity would be the most disruptive trend in dealmaking over the next year.

Cybersecurity is clearly a huge concern among dealmakers (and rightly so), but with technology so central to the process, simple inefficiencies can be just as costly. While only ten per cent of dealmakers (MergerMarket) ranked this as a top two concern heading into 2022, technology is now so vital to M&A that entire deals could be at risk from any faults or outages.

With this in mind, here are some of the potential threats that dealmakers might face and the consequences they may have for M&A deals. We’ll also examine some of the steps that parties can take (individually and collaboratively) to ensure that cybersecurity and tech malfunction risks are managed, minimised and prevented from impacting or derailing the deal.

Potential threats and their costs for M&A deals

Loss of value
In an M&A deal, a cybersecurity or tech issue can have a direct impact on the value of the transaction. If a target company falls victim to a cyberattack or a major tech issue during the deal process, then this will undoubtedly have a negative impact on the buying company’s valuation of the business, in particular of assets such as customer goodwill and brand reputation.

Value can also be damaged if a previous tech/cyber issue comes to light during the due diligence stage of the deal.


In July 2016, multinational telecoms firm Verizon struck a deal to acquire search engine giant Yahoo, in a transaction that valued the company at approximately £3.6 billion ($4.8 billion). However, later that year, prior to the deal’s completion, Yahoo disclosed three historic data security incidents, news that impacted the deal hugely.


The first announcement came just two months after the deal was agreed, when Yahoo confirmed rumours that it had suffered a data breach around two years earlier. The breach, thought to have occurred in late 2014, involved a suspected state-sponsored attacker and compromised the account information of around 500 million users. Names, emails and addresses were among the personal data thought to have been stolen, as well as security questions and answers.


The issue was compounded the following December, when Yahoo disclosed another data breach. This data breach, which occurred in August 2013, is thought to have potentially impacted nearly 1 billion users, essentially Yahoo’s whole user base. The company simultaneously announced breaches occurring in 2015 and 2016, in which an unknown number of user accounts were accessed via forged cookies.


Luckily for Yahoo and its investors, Verizon opted to persist with the acquisition, maintaining that the deal made “strategic sense”. Yahoo was also arguably fortunate that just £262.5 million ($350 million) was knocked off the acquisition price – the deal ultimately closing for £3.35 billion ($4.48 billion) – with Verizon reportedly having initially sought to knock around £750 million ($1 billion) off the price.

Loss of trust
Trust between the parties involved is obviously an absolutely vital part of any successful M&A deal. As a result, it stands to reason that any breach or tech malfunction could put this at risk, particularly if one party is at fault for the issue, attempts to hide the problem from the opposite firm or seeks to apportion blame elsewhere.

If, for example, a previously damaging cyber-incident was not disclosed by the target firm but was subsequently discovered during due diligence, this could not only harm the buying firm’s valuation of the company, but also the trust between the two parties as they head into the negotiation phase.
Once trust is severed in this way, it is incredibly difficult to repair and could have a severely negative impact on the deal, to the point of derailing it completely.

Legal and regulatory implications
M&A deals are processes in which considerable amounts of highly sensitive data are exchanged between companies. If such data is compromised in some way, then there may be legal recourse if one of the parties is deemed to be at fault. For example, if sensitive data regarding the target company was leaked by the potential buyer, either through human error or insufficient cybersecurity, then this could have serious legal implications.

With data protection more important than ever, this is also an area in which regulators have adopted a more stringent approach in recent years. Since the end of the Brexit transition period at the beginning of 2021, UK data regulation is covered by the UK-GDPR (General Data Protection Regulation) and these rules extend to M&A transactions.

Under the UK-GDPR, firms that are found to have infringed upon data regulations can face a maximum fine of either £17.5 million or 4 per cent of their annual global revenue, whichever amount is greater. While this is obviously a worst-case scenario covering the most severe infractions, the possible sanctions in place show how seriously regulators take data breaches of any kind – and M&A deals represent a time at which companies are perhaps particularly vulnerable to data compromise.

An added threat when undertaking acquisitions is that buying companies can find themselves liable for historic breaches at the target company that are discovered or disclosed post-acquisition. This can result in companies facing hefty fines for incidents that they had nothing to do with and highlights the importance of a rigorous due diligence process examining every aspect of a target company’s security and attack history.


In 2016, hotel giant Marriott International acquired Starwood Hotels, an international group operating hotels, resorts and spas. However, unbeknownst to the two parties, Starwood had fallen victim to an attack two years earlier.


In 2014, a hostile actor – that remained unknown – installed code into a device on the Starwood system, which gave the attacker access and the ability to edit the device’s contents remotely. After installing malware, the attacker had unrestricted access to the device and others on the network.


Further ‘bad agent’ tools were installed, ultimately giving the attacker a significant degree of access to a huge array of personal data relating to guests around the world. This may have extended to information such as names, phone numbers, passport numbers, email addresses and VIP status.


Following the discovery of the breach in 2018, Marriott was investigated by the Information Commissioner’s Office, which found that the necessary technical and organisational measures to protect personal data on company systems were not in place.


The ICO acknowledged that, upon discovering the breach, Marriott had acted quickly to notify both customers and the ICO, mitigate the risk posed to customers and to implement measures to improve security. However, the incident still led to the ICO fining Marriott International £18.4 million for failure to secure the personal data of its customers.

Financial attack
M&A deals involve the transfer of huge sums of money and the dealmaking market is naturally one that attracts a considerable amount of media attention, with particular interest often taken in the financial aspect of a deal. This means that M&A deals are especially vulnerable to financially motivated cyberattacks, particularly in the case of high-profile deals in which details such as the acquisition fee or a detailed breakdown of how the fee will be paid are disclosed and widely reported.

Deal delay or collapse
Of course, the impact of a tech or cyber issue could be severe enough to result in the deal being delayed or even scrapped entirely. A tech malfunction that takes critical systems offline or a cyberattack that compromises the cybersecurity of either party could set a deal back by months until the issue is resolved.

Similarly, there are numerous potential issues that could see the deal get scrapped entirely. For instance, a particularly damaging data leak during the deal itself, the discovery of a major security incident that wasn’t disclosed or the target firm’s systems being found to be in need of a level of investment that the buyer is not willing to undertake.

Post-deal integration issues
Tech and cybersecurity issues also regularly make themselves apparent after a deal has completed, posing challenges for the post-deal integration process and the ultimate success of the acquisition. Buying firms should of course be mindful of this and plan for the fact that there will be some tech issues that need addressing once the deal has gone through.

Many of the post-deal integration issues will be predictable challenges that a buyer can identify at the due diligence stage and plan well in advance for. This might include updating legacy tech, strengthening the target company’s cybersecurity or migrating relevant data to new systems and platforms.

However, there are certain risks that may be relatively unforeseen and can cause major damage post-acquisition. For example, a vulnerable point in the network or tech inefficiency that is not disclosed or discovered during due diligence could potentially be infiltrated or spread during the integration phase, resulting in the buying firm’s systems being impacted and compromised.

Similarly, gaps in cybersecurity can leave both companies in a position of ongoing vulnerability post-acquisition, leaving the businesses open to risks such as ransomware attacks or data breaches that could result in infringements of UK-GDPR regulations and potential financial sanctions.

How can dealmakers alleviate and manage risks?

Assess and understand risks pre-deal
Perhaps the most important way to avoid a deal being scuppered by tech and cyber risks is to take the time beforehand to assess and understand the potential risks. It will be vital for each party to identify risks that could arise, including general threats, such as technology inefficiencies or data leaks, as well as more specific risks that a company in a particular sector might face, such as cyberattacks seeking to take an e-commerce business’ online operations out.

For the buying company, it will be crucial to assess the systems, safeguards and responses in place at the target business. After all, in an acquisition, the buying company will be taking on all the threats and vulnerabilities that come with the target business. During due diligence, buyers should look at things such as how the company has responded to previous incidents, the type of data it holds, what controls it has to protect this data and what its protocols are for different types of breach.

For the deal process itself, the two parties should assess the risks inherent in sharing data and plan how information relating to the businesses and the deal itself can remain secure throughout the process of the acquisition.

By identifying risks in advance, it will become easier to plan on how to navigate them should they arise. Aside from making the deal process more secure, the two parties working in tandem to identify risks and incident responses can be crucial in fostering a sense of trust at the outset of the transaction. Furthermore, for the buying firm, gaining a thorough overview of the systems and processes in place at the target company will be crucial in spotting risks that might arise during integration, helping to make the post-deal process more successful.

Ensure adequate protection during the deal
During the deal itself, there are measures that can be taken to ensure that the process is handled securely and that the relevant documents and sensitive information are protected.

In modern M&A deals, virtual data rooms have become a common solution for dealmakers, particularly so since the COVID-19 pandemic made social distancing and the need to work remotely pressing concerns. Cloud-based data rooms give dealmakers the ability to securely and confidentially share, exchange and review documents and other information that might be required during due diligence and other stages of the M&A process.

Data rooms employ advanced security features such as encryption and multi-factor authentication, as well as offering the ability to implement measures such as minimum permissions, which ensures that documents are only viewable to the relevant people. Furthermore, data rooms can be automatically updated with the latest security measures and improvements directly from the provider.

Strong disaster response protocols
In an increasingly digital world, disaster recovery (DR) plans are a vital component of many businesses and, as M&A becomes ever more reliant on technology, they should also be applied to dealmaking processes.

DR helps businesses respond to incidents such as cyberattacks, power outages, data breaches or even natural disasters. The plans, when executed, are designed to help respond to such incidents, minimise their impact and enable the businesses to continue or resume operating as soon as possible.

As with virtual data rooms, DR plans are often sold to companies by cloud service providers as part of their package (Disaster Recovery as a Service – DraaS – is a common feature of cloud solutions). However, developing proper DR protocols for M&A deals will also require companies to undertake some degree of independent training and develop specific plans for potential incidents, as well as sharing these protocols with the opposite party in order to ensure a co-ordinated response to any issues.

Worst case scenario - Responding to incidents

Of course, despite the measures dealmakers can take, cyber incidents and tech outages do still occur and businesses will need to be prepared to respond to them.

If, during the deal process, the target company is hit by a serious tech or cyber issue, an immediate response to execute the relevant disaster response protocol is paramount. . Providing this is done quickly and the protocols are properly developed and effective, damage should be minimised.

There are four key aims when responding to a tech or cyber incident: identify the issue; assess the issue and the damage caused; resolve the incident; restore operations. Measures taken to respond to certain issues might include generating data backups in the event of a data breach or, in the case of a cyberattack, blocking IP addresses and removing infected devices and programmes from the network.

Communication is key during a cyber incident and it will be vital to keep the opposite party and all relevant shareholders abreast of developments during the response process. Another crucial early step will be to engage legal counsel in order to ensure that relevant evidence and information about the incident is collected and preserved.

Conclusion

By now, technology and digital solutions are so ubiquitous in the dealmaking process that planning for and responding to tech and cyber-related incidents is now a foundational part of the M&A process.

Prior planning and co-ordination between the different companies involved in a deal can help to massively reduce the risks a deal may face, as will adopting the tightest cybersecurity measures throughout the process. However, incidents can still occur, meaning that planning how to respond is just as vital as taking measures to prevent such incidents happening.

Ultimately, dealmakers that have prepared thoroughly with their tech team will be the ones best equipped to avoid tech faults, repel cyberthreats and respond to incidents that do occur. The key to managing and mitigating the risks posed to M&A deals is to ensure vigilance and preparation throughout the deal process, from the initial stages, through to due diligence and negotiations, as well as during post-deal integration.

Share this article

Latest Businesses for Sale

---

---

---

View more businesses for sale