Cyber Due Diligence for M&A: checklist, red flags and deal clauses
Phase-by-phase cyber and privacy due diligence checklist for M&A, red flags that affect valuation, SPA clauses (R&W, indemnity, escrow, W&I) and public cases like Verizon–Yahoo and Marriott–Starwood.
Pre-LOI: outside-in assessment
- Public incident history — Search for breaches, attacks, fines and lawsuits tied to the target and its brands over the last 5 years.
- Exposed attack surface — Map domains, subdomains, exposed services and certificates to estimate technical hygiene without internal access.
- Leaked credentials and data — Check whether the target's corporate emails, credentials or databases appear in known leaks.
- Weight of personal data in the business — Understand how much revenue depends on personal, sensitive, children's or financial data, which changes the size of regulatory risk.
- Regulated sector and country — Banking, healthcare, telecom, energy and listed companies have their own cybersecurity and incident disclosure rules.
Data room due diligence
- Security governance — Who owns security, how much is spent, how the board oversees it and which frameworks are followed (ISO 27001, NIST CSF, SOC 2).
- Incident log — All incidents from the last 3 to 5 years, with cause, impact, notifications to authorities and individuals, and fixes.
- Tests and vulnerabilities — Latest pentests and scans and what remains unfixed; open critical vulnerabilities weigh on price.
- Identity and access — MFA, privileged accounts, access by former staff and vendors; the most common way in.
- Backup and continuity — Isolated, tested backups, recovery time and ransomware response plan.
- Critical third parties — Cloud, software and service vendors with access to data or systems, contracts and security clauses.
- Current cyber insurance — Coverage, limits, exclusions, past claims and whether the policy survives a change of control.
Privacy and regulatory (LGPD, GDPR and others)
- Legal bases and consents — Data collected without a valid legal basis may be unusable by the buyer, affecting synergies and valuation.
- DPO and privacy program — Whether there is a DPO, policies, impact assessments and handling of data subject requests.
- Ongoing proceedings and inspections — Proceedings before the ANPD, consumer bodies, prosecutors, European authorities or the FTC, and class actions.
- International data transfers — Mechanisms used to send data abroad (standard clauses, adequacy decisions).
- Sector rules — Central bank, health, telecom and securities regulators' rules on security and incident disclosure.
Contract and price (SPA)
- Turn findings into price — Remediation cost, possible fines and lost revenue go into valuation or become a price adjustment.
- Specific reps and warranties — Representations on incidents, data law compliance and minimum controls.
- Indemnity and holdback — Specific indemnity for pre-closing incidents, backed by escrow or a holdback.
- W&I insurance and exclusions — Insurers often exclude known or poorly diligenced cyber risks; confirm what stays uncovered.
- Conditions precedent — Fixing critical gaps (for example MFA on privileged accounts) before closing.
First 100 days after closing
- Do not connect networks before assessing — Integrating systems without assessment can carry an intruder from the target into the buyer.
- Compromise assessment — Look for signs of an existing intrusion, as in the Starwood case, where the intruder went undetected for years.
- Rotate credentials and review access — Rotate privileged passwords and keys and remove access for sellers and former staff.
- Unify incident response — One plan, contacts and notification deadlines (ANPD, regulators, SEC) for the combined group.
- Continuous due diligence — The UK regulator said in the Marriott case that due diligence is not a one-off requirement but an ongoing one.
Clauses
- Cyber and privacy reps & warranties — The seller states there were no incidents beyond those listed, that it complies with LGPD/GDPR and keeps minimum controls.
- Special indemnity — Covers losses from pre-closing incidents, even if found later, outside the general caps.
- Escrow or holdback — Part of the price is held for a period to pay possible cyber losses.
- Price adjustment — Mechanism to cut the price if a material incident is revealed before closing, as in Verizon–Yahoo.
- Remediation condition precedent — Closing depends on fixing critical gaps found in diligence.
- W&I insurance and cyber exclusions — Check what the policy excludes and cover the gap with a special indemnity or cyber insurance.
- Cooperation and notice — Duty to promptly report incidents between signing and closing and to cooperate in the response.
- Material adverse change (MAC) — Define whether a severe incident lets the buyer walk away or renegotiate.
Cases
- 2017 · Verizon cuts Yahoo price by US$350m — After two breaches affecting over 1 billion users came to light, the price fell to US$4.48bn and the parties agreed to share legal costs from the breaches.
- 2018 · SEC fines Altaba (former Yahoo) US$35m — The SEC's first penalty for failing to disclose a breach: the 2014 attack was only revealed in 2016, and in talks with Verizon Yahoo allegedly mentioned only minor incidents.
- 2020 · Marriott fined £18.4m over breach inherited from Starwood — The attack began in 2014 in the systems of Starwood, acquired in 2016, and affected up to 339 million guests. The UK ICO cut the proposed £99.2m fine and said due diligence is not a one-off requirement.
- 2022 · Canada's privacy commissioner backs findings in the Starwood case — Canada's privacy commissioner (OPC) issued a September 2022 report largely agreeing with the UK findings on the breach that began before the acquisition.
- 2024 · Marriott pays US$52m to 50 US states — Settlement with 50 attorneys general and the FTC over the Starwood database breach: intruders went undetected from July 2014 to September 2018, affecting 131.5 million US guest records.