Cybercriminals routinely prey upon companies during M&A activities, evaluating the best window of opportunity in which to maximize the exploitation of a critical vulnerability.
When a M&A announcement goes public, attackers can multiply their malicious hunting activity as they search for unmonitored assets in the acquired company that can serve as an entry-point to the larger organization post-acquisition and integration. An example of such a case where an acquisition was targeted is when Marriott acquired Starwood in 2016. Marriott failed to perform a comprehensive cybersecurity audit during the M&A process and, as a result, Marriott discovered in 2018 that its Starwood systems had been compromised since 2014. This led to hundreds of millions of consumers’ information being exposed, unquantifiable reputational damage, and Marriott being levied with a hefty $120 million fine from the UK Information Commissioner’s Office (ICO), with additional penalties likely to follow.