Cyber Threats Targeting Mergers and Acquisitions

3. Steps of the Merger/Acquisition Process
While evidence shows that corporate espionage is alive and well, and that actors have been
successful in infiltrating many organizations with novel and indirect approaches, it’s important to
understand where in the standard M&A process attacks can occur, and why.
Figure 1 - The merger and acquisition process.
While each merger or acquisition process will have its own nuances, all tend to follow the five broad
stages illustrated in Figure 1. The following sections provide an overview of the cyber threats an
organization is likely to face at each of these five stages.
Preparation for acquisition and/or valuation
The first identifiable stage of the process is the preparation for the acquisition or valuation of
an organization. At this point, even though an official announcement has not been made, an
organization is already vulnerable to threats. The potential buyer and the seller are both potential
threat vectors. Organizations may take steps to make themselves more appealing to deal makers
– perhaps through activity such as a second round of funding or other business decisions. Keen
financial analysts may draw conclusions for themselves based on this activity, examples of which
can be seen in public news posts such as Fortunes’ Term sheet blog, or as a result of inadvertent
data leakage on social media or blogs.
Sensitive information need not be explicit, however. As Figure 2 demonstrates, company-published
job postings to sites such as LinkedIn looking to hire someone with M&A experience, or a person
that would typically lead or be involved in the process such as a corporate development executive,
can be a clue that M&A activity is in the offing.
7