The Brave New World of Cybersecurity Due Diligence in Mergers and Acquisitions: Pitfalls and Opportunities

Beyond physical systems, human factors play a significant role in M&A cybersecurity. Mergers of two organizations change processes, internal employee and customer relationships and reporting hierarchies. Departments, functions and locations have less familiarity, forcing employees to deal with people, places, systems and processes that are unfamiliar to them. Hackers use this change and lack of familiarity to launch social engineering attacks, like phishing scams or ransomware, attempting to trick employees into defeating security measures or divulging confidential information.

In 2005, a hacker convinced Wachovia bank employees to sell account information on more than 676,000 customers by claiming to be a collection agency. See, “Bank security breach may be biggest yet: Account info at Bank of America, Wachovia sold by employees” CNN Money, May 23, 2005. Within a short period, employees that normally performed 50 account searches a day began searching up to 500 accounts, copying and selling the data. Wachovia was not alone. Merged and acquired entities are particularly vulnerable to employee breaches when entities fail to rationalize employee identity and access controls. In this case, security protocols should have flagged a 10-fold increase in account searches without a corresponding increase in need.

Next Steps for M&A Professionals

The M&A industry may benefit from considering disruption from past technological innovations in analogous legal processes. As a new lawyer in the early 1990s, I spent months overseeing the manual review and cataloging of truckloads of banker's boxes of documents for litigation discovery. E-discovery brought new methods and means to identify, preserve and catalogue documents for use in litigation which are now norms for professionals in litigation. Likewise, in recent years, M&A processes have focused on privacy issues and the risks associated with reporting data breaches. M&A professionals would benefit from considering needed changes for the M&A process to account for cybersecurity in addition to data privacy and breach. Richard Harroch, managing director and global head of M&A for VantagePoint Capital Partners, cautions that traditional M&A lawyers may lack awareness of the broader cybersecurity issues and need to add new capability to their teams — such as IT and cybersecurity expertise. See, Richard Harroch, et al “Data Privacy and Cybersecurity Issues in Mergers and Acquisitions” Forbes Magazine, Nov. 11, 2018. M&A professionals will need a degree of education as to the technical risks and possibilities to consider impact on their processes.

Regulatory concerns are also prompting this new consideration of cybersecurity. The SEC's recent guidance on cybersecurity disclosures requires companies to disclose material cybersecurity risks and incidents. Materiality considers, among other things, “harm to a company's reputation, financial performance, and customer and vendor relationships, as well as the possibility of litigation or regulatory investigations or actions, including regulatory actions by state and federal governmental authorities and non-U.S. authorities.” See, Commission Statement and Guidance on Public Company Cybersecurity Disclosures, (SEC, Feb. 21, 2018).

To comply with privacy and consumer protection laws, along with regulatory and industry standards, M&A teams will need to develop organizational cybersecurity maps and risk assessments that consider the type and means of data collection, storage and access as well as legal assessments of policies, procedures and contracts. The due diligence will also be wise to consider the post-M&A entities and realities of cybersecurity in considering post-closing deal considerations and attribution of liability and value.

Risks associated with human factors need to be addressed. Considerations can include: technological controls, rationalizing employee identity, background checks and access controls to systems and information, as well as policies and legal agreements such as intellectual property policies and agreements, non-disclosure agreements, non-compete agreements and severance agreements.

Due diligence may also need to consider system testing including independent assessments and “Dark Web” style penetration tests, reviews of past breaches for remediation measures and ongoing obligations from both a technical as well as a legal perspective.

The due diligence process also would benefit from considering crisis management, continuity plans, disaster recovery, hosted solutions providing employees with resources and instruction for responding as well as guidance on who to direct inquiries to in the event of a breach or crisis during the M&A process or after a merger. This would include a legal appraisal of underlying contractual, liability and governance agreements for these issues not typically addressed in many M&A situations.

Analysis

In short, comprehensive cybersecurity due diligence recognized the new and changing world being formed by cyber threats and cybersecurity. M&A processes will continue to need to quickly adapt to consider and integrate cyber awareness with legal risks and opportunities to provide a comprehensive appraisal and solution to cyber-related vulnerabilities associated with systems, humans, data processes, impact on value and legal and industry considerations.

*****

Thomas McThenia is a shareholder and managing director at GrayRobinson's Gainesville office where he practices in cyberlaw, intellectual property, technology, licensing, M&A and commercial transactions. Tom represents a wide array of clients including multinational corporations, nonprofit organizations, universities, start-up and emerging-growth companies, technology and internet companies, and individual entrepreneurs. He may be contacted at [email protected]. Richard Markow is a an Associate at GrayRobinson.