With Apple’s purchase of Beats, Pfizer’s failed bids for AstraZeneca,
and
experts pointing to a rally in the M&A market, the last
month was a busy one for mergers and acquisitions. Of course, when we
first see headlines of a high profile company’s plans for a merger or
acquisition, we rush to think of the strategic and industry
implications of such a deal. But underneath the “what ifs” and
“visions for the future,” is a darker side of M&A that doesn’t
make the headlines: the routineness with which companies are breached
and crucial data is stolen when two high-profile organizations look to
join together.
Over the last few years, concerns over economic espionage have led to
greater scrutiny of mergers and acquisitions involving foreign
companies – particularly in industries with sensitive technologies and
operations that could pose broader economic and security threats.
However, entering into a merger or acquisition with a foreign company
is not the only way nation-states conduct economic espionage via cyber
means, nor are nation-states the only perpetrators of intellectual
property theft.
From our experience responding to these breaches, we’ve seen targeted
threat actors actively pursuing companies involved in mergers and
acquisitions in two ways:
From One Friend to Another: Taking Advantage of Trusted
Relationships Between Companies
Some threat groups compromise an organization’s environment and then
move laterally over a connected network to a partner or subsidiary,
while others rely on social engineering tactics, such as the use of
phishing emails that appear to be from employees at the partner
company. We have seen China-based threat groups previously compromise
targets by taking advantage of trusted relationships and bridged
networks between companies. Regardless of their method of entry, these
actors are often in search of the same thing: intellectual property
and proprietary information that can provide their own constituents
with a business advantage, whether through adopting a rival’s
technology and products, securing advantageous prices, or any other
tactic that could give them a leg up.
We investigated one incident in which two threat groups compromised a
company shortly after it acquired a subsidiary. The threat actors used
their access to the initial company’s network to move laterally to the
subsidiary, which had recently developed a proprietary process for a
significant new healthcare product. Once inside the subsidiary’s
network, the threat groups stole data that included details on the
product’s test results. We believe the threat groups sought to give
that data to Chinese state-owned companies in that industry for
fast-tracking the development of their own version of the
groundbreaking product.
Cheating the System: Insider Advantages in Negotiations
We have also seen threat groups compromising organizations involved
in merger or acquisition talks with Chinese entities, likely in an
effort to steal data that could give negotiators and decision makers
valuable insider information with which to manipulate the outcome of
the proposed transaction. Unlike other types of economic espionage
operations, the threat groups in this type of scenario are generally
not in search of a company’s intellectual property. Instead, these
actors look for data such as executive emails, negotiation terms, and
business plans and information; all of which could benefit the
negotiators by giving them insight into the victim company’s financial
situation and negotiation strategy.
During one investigation, we found that a China-based threat group
had compromised a company that was in the process of acquiring a
Chinese subsidiary – a move that would have significantly increased
the victim company’s manufacturing and retail capacity in the Chinese
market. The threat actors accessed the email accounts of multiple
employees involved in the negotiations in what was likely a search for
information pertaining to the proceedings. We believe that the threat
group then used the stolen information to inform Chinese decision
makers involved in the acquisition process, as the Chinese government
terminated the talks shortly after the data theft occurred.
What can we expect?
Companies involved in mergers and acquisitions need to be aware of
the risks they face from threat actors intent on conducting economic
espionage. Entering into a merger or acquisition with an organization
that has unidentified intrusions and unaudited networks places a
company at risk of compromise from threat actors who may be waiting to
move laterally to the newly integrated target.
Similarly, companies, and the law firms representing them, involved
in negotiations with Chinese enterprises face risks from threat groups
seeking to provide the Chinese entity with an advantage in
negotiations. Compromise and economic espionage can have profound
impacts on a company’s finances and reputation at any time, but
particularly when they are risking hundreds of millions to billions of
dollars on M&A.
In many cases as well, there are broader issues of national security,
so it’s imperative that companies seek to recognize and mitigate these
risks as part of their M&A processes moving forward. Even
governments sometimes attempt to mitigate these risks by conducting
national security reviews and occasionally rejecting bids based on
their findings.[i] Threat actors from
many countries engage in economic espionage, making for a wide and
varied threat landscape that cannot be handled by the government
alone. For examples of just how diverse and crowded a space the
targeted threat landscape is becoming, see our recent blog posts on
Rose, and
and Ukraine.
[i] “The Committee on Foreign
Investment in the United States (CFIUS).” U.S. Department of the
Treasury. 20 Dec. 2012. Web. 28 May 2014.