The Brave New World of Cybersecurity Due Diligence in Mergers and Acquisitions: Pitfalls and Opportunities

For the casual observer, mergers and acquisitions (M&A) deals in the 20th century occurred in a staid and established world carefully controlled and choreographed by Wall Street investment bankers and lawyers. Like poorly-behaved school children, new technologies and intellectual property (IP) are increasingly disrupting the M&A establishment. Digital and data technologies revolutionized transactions in the 1970-80s; intellectual property came to the forefront as a source of significant value and collateral in the 1990s and, Internet technology created vast wealth in the early 2000s.

Cybersecurity has become the latest disruptive newcomer to the M&A party. As expanding technology allows companies and platforms to capture, store and distribute critical enterprise, supplier and customer information, attacks are spreading. Traditional M&A due diligence processes struggle to keep pace with increasing cybersecurity problems.

Cybersecurity: The New Kid on the M&A Due Diligence Block

The unique ways that information moves through the networks and channels of entities and M&A participants exposes new vulnerabilities during the M&A process. Interconnected networks extend connectivity and access beyond a single company's control. Comprehensive cybersecurity due diligence is required to consider the processes and systems that protect the integrity and value of proprietary data, personally identifiable information (PII), and business and financial information. Hacks and cyber threats occur at all stages of M&A deals. The present material risks to impact the value of the deal and the companies involved. Considerations for cybersecurity due diligence are different at each stage of the M&A process.

Before Announcement of the Deal

Verizon's recent acquisition of Yahoo! illustrates the need to start cybersecurity due diligence before a deal's announcement. Verizon was caught unaware learning about two unreported data breaches of Yahoo which occurred pre-announcement. The unexpected breach information resulted in Yahoo! being devalued by $350 million and caused significant delays in closing the deal. See, Claire Meyer, “Q&A: How are cyber risks changing Mergers and Acquisitions?” Security Magazine, Jan. 31, 2018. The liability did not end there. Post-deal, Yahoo!'s successor entity was ordered to pay $85 million to settle a class-action and was subject to FTC remediation measures. A comprehensive cybersecurity due diligence process conducted before the announcement could have alerted deal makers to the materiality of the issue enabling them to better mitigate risks before announcing the deal.