We use cookies to personalize content and to provide you with an improved user experience. By continuing to browse this site you consent to the use of cookies. Please visit our cookie policy for further details. I understand Skip to footer PwC | United States Search Search Share Menu Show full breadcrumb Services Deals When cyber threatens mergers and acquisitions (M&A) My account My Lists When cyber threatens M&A Buying another company means taking on its digital operations, which can pose fresh and potentially deal-altering cybersecurity risks. These threats can jeopardize a deal’s anticipated value unless the acquirer identifies and addresses them early in the process. Cyber issues can raise M&A costs and reduce value Cyberattacks on companies can do more than violate laws and regulations. A business that is being acquired or generally exploring a sale typically wants a maximum return, and the acquirer wants to make sure its target is valued appropriately and is a sustainable asset. Insufficient investment in cybersecurity and digital infections can hamper or even kill those goals by reducing the value of the target’s assets, damaging its brand and derailing its growth prospects. Many executives say data breaches, especially public ones, can lower a deal’s valuation. That was evident in Verizon’s acquisition of Yahoo, which closed in 2017. After Yahoo’s disclosure of two massive breaches in previous years, Verizon cut its offer by $350 million, or about 7 percent of the original price. In addition, the part of Yahoo that wasn’t sold to Verizon agreed to assume 50% liability from any future lawsuits related to the data breaches. Risks across different sectors This isn’t an issue for only tech companies. Cyber threats have spread to industries that weren’t targeted earlier in the digital age; restaurant chains, for example, can be attacked for the customer information – either credit card numbers or information from their loyalty programs. And the goal can be more than a simple data grab. Consider a pharmaceutical company’s formula for a drug, a manufacturer’s product design or a distribution company’s transportation model. All of that is intellectual property that can be a crucial part of a deal’s value. More anxiety and consequences The risks for an acquirer in this environment are increasing. An acquisition that has existing cyber vulnerabilities can be used by threat actors to obtain access to the acquiring company as the integration progresses. The period between a deal’s announcement and closing is of particular exposure if vulnerabilities exist, given the heightened awareness and opportunity. That potential can raise anxiety among stakeholders – including investors, shareholders, customers, employees and suppliers – bringing further risk of disruption. While cyber threats are more prevalent, it’s still rare for a breach or other issue to harm a transaction to the point that an acquirer completely walks away; delaying the transaction is a more common result. Yet delays, added costs and questions about a target’s value all have consequences for the deal process. To avoid such damage, acquirers need to understand the cyber risks of the target so they can limit surprises, model appropriately and ensure a reasonable transaction. The road to reducing threats Knowing the cyber risks Taking action Cyber due diligence Mitigating cyber risks Knowing the cyber risks in deals Once a transaction comes into focus and an acquirer wants to determine the target’s real value, it needs to address two key areas. Security includes the history of cyber events, the controls in place and the assets at risk in a connected environment. Synergy involves determining how different the target’s systems and protocols are from the acquirer. Read more Next steps for dealmakers For a transaction to proceed with an understanding of the cyber risks, an acquirer must incorporate cyber issues into its assessment of a deal target. With this insight, the risks and cost can be factored into the deal model, negotiation and Day One planning. This includes understanding key cyber risk indicators, including: The state of the target’s cybersecurity program, the compatibility and resiliency of its IT operations to cyber incidents, and which applications are vulnerable to attack – and by whom. The amount and nature of data and information the target is responsible for, what is most sensitive and valuable, and how it is protected. If and how the target complies with government regulations and global privacy requirements, and if that compliance adequately guards against industry-specific or other cyber threats. The costs of addressing the above concerns and the impact not only on deal negotiations and pricing but also the acquirer’s business, brand and reputation going forward. Focusing on these areas during a deal will help minimize the chances of digital disruption that could create additional challenges – in the short or long term – and result in an acquirer regretting what once was a promising deal. View the full report When cyber threatens M&A You might also be interested in How your board can be effective in overseeing cyber risk Companies are under constant attack. Are they getting cybersecurity right? Save CEO Survey and Deals For US companies, M&A will help drive growth in 2018. Save Contact us Todson Page Partner, PwC Deals, PwC US Tel: +1 (408) 817 1223 Email Mike Cunning Managing Director, PwC Cybersecurity & Privacy, PwC US Tel: +1 (973) 236 4493 Email Follow us Audit and assurance Consulting Tax services Newsroom Alumni US offices Contact us © 2017 - 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. Privacy Privacy Shield Cookies info Legal Terms and conditions Site provider Site map