Recent Searches
In brief
Most executives with a divestiture on their minds probably don’t automatically associate deals with breaches and ransomware attacks. But cybercriminals do.
While deal teams are thinking about preparing and executing the deal, bad actors are watching the headlines for opportunities to launch attacks while the stakes are high and executives’ backs are turned. Monetarily, the company is an attractive target because the impending deal has greatly increased the cost of the possible release of nonpublic information.
Ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections
The FBI has taken note of a recent explosion in ransomware attacks, issuing a warning in November 2021 that attackers are using “significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections.”¹ Likewise, the EY-Parthenon dedicated transaction cybersecurity team has witnessed increasing cyber attacks on companies doing deals, including cases that were very costly for the victims.
The potential damage is similar to the risks normally associated with cyber attacks — loss of protected information and data, exposure of trade secrets, legal judgments, fines and impact on customers. Financial losses can pale compared to reputational damage. And now, the stakes are far higher because there’s also a deal at risk.
For example, a $650 million acquisition by an airline of an aerospace component supplier fell apart in 2019 partly due to a ransomware attack that forced temporary factory closures at the target company. The supplier was acquired by a different company two years later.²
Fortunately, organizations can substantially reduce their exposure by guarding cybersecurity throughout the planning and execution of the transaction. Below, we explain two types of risks — transaction and counterparty risk — as well as the different phases of the transaction where these risks are likely to occur.
A pending deal creates vulnerabilities for hackers to exploit.
Transaction risk results from a change in management and employee behavior in the parent organization following the announcement of a deal. Management becomes focused on completing the transaction and separation, and employees with transition tasks or uncertainty on their minds are more likely to let their guard down and fall victim to a phishing attack or other ruse. The EY-Parthenon team has conducted transaction-related phishing campaigns with clients that show employees are 50% more likely to click on a phony email after a company has announced that a deal is underway. Some employees may also become insider threats as they consider taking proprietary information to their next employer or may even commit destructive acts in “protest.”
Counterparty risk arises after the sale and transition processes are underway with the buyer. It is the result of inadequate deal planning, when a party in the deal is not prepared to implement cybersecurity, governance, compliance and strategy as agreed to meet day one requirements. This can mean they are not ready to exit the transaction services agreement on time, resulting in insufficient controls, additional costs and delays, or even jeopardizing completion of the deal. If the buyer team is not experienced with cybersecurity, the process can also expose the seller to additional risk while the entities are still connected to shared technology assets.
Deal-related cyber risks, which exist for both the divesting company and the entity being sold, can be segmented by major phases in the deal cycle.
Fortunately, a few key defensive measures can go a long way to making an attack less likely or to limiting the damage if an attack does occur. Companies can view the entire deal process through a cybersecurity lens, with early and continuing attention on preventative steps:
For many companies pursuing a deal, the biggest step in defending against a cyber attack is to first recognize that the deal itself brings a greater likelihood of an attack. Companies that take sensible steps to embed a cybersecurity strategy throughout the deal cycle will be better positioned to avoid a problem and complete their deal successfully.
Cybersecurity due diligence in M&A and divestitures
Learn how EY teams can help you identify vulnerabilities, quantify cyber risks as they relate to the deal and manage mitigation or remediation of cybersecurity in M&A.
The CIO Imperative: Is your technology moving fast enough to realize your ambitions?
Data centricity can be an insight engine that unlocks operational, customer and market data value, according to EY’s 2022 Tech Horizon survey. Read more
How can your digital investment strategy reach higher returns?
The 2022 Digital Investment Index reveals that companies struggle with digital strategy and measuring returns on their technology investments. Read more.
