Guarding Against Deal Leaks: Strategies for Confidentiality in M&A

Welcome to the second episode of the first season of The Dealist, focusing on the critical topic of due diligence. Today, we’re turning our attention to mergers and acquisitions (M&A) deal leaks — why they happen, how they can derail transactions and what dealmakers can do to protect confidentiality throughout the M&A process.

Together, we explore the difference between strategic and accidental leaks, the role of cybersecurity and training, the tools and processes that can mitigate risk, and how leaks impact both deal timing and public perception.

Listen in for practical insights and real-world examples that will help you navigate one of the most sensitive aspects of M&A due diligence.

• The difference between intentional and accidental leaks
• Impacts of leaks on private and public M&A markets
• The role of virtual data rooms (VDRs), governance and training in safeguarding sensitive data
• Strategies to address breaches and reinforce confidentiality

Guests:

• Dan Scorpio, Head of M&A and Activism at communications firm H/Advisers Abernathy
• Nitin Kumar, Independent Market Commentator
• Matt Wells, Vice President of Product Marketing at SS&C Intralinks

Host: Catherine Ford

Additional reading: 2024 SS&C Intralinks Deal Leaks Report

Explore our INsights blog for more expert analysis and dealmaking trends. 

Discover how Intralinks DealCentre™ revolutionizes deal management with cutting-edge AI technology and smart solutions here. 

Transcript

Welcome to The Dealist, the insider's guide to M&A. My name is Catherine Ford, and I'm your host. Today, we're going to be talking about deal leaks and how to preserve confidentiality during an M&A process. I'm delighted to have been joined by Matt Wells, vice president of product marketing at Intralinks; Dan Scorpio, head of M&A and activism at communications firm, H/Advisers Abernathy; and Nissin Kumar, an independent market commentator. Thank you to all three of you so much for joining us today.

Let's get straight stuck into the topic. As we all know, deal leaks can have an outsized impact on M&A transactions and the success of M&A transactions. Let's start, Dan, by talking to you a little bit about how we can differentiate between planned leaks and unplanned leaks. First of all, why do you think leaks actually happen when it comes to an M&A process?

So thanks, Catherine. There are many reasons that a leak might happen in an M&A process, and I think your question is exactly right. It's helpful to start to distinguish between a planned or a strategic leak and an unplanned leak. On the plan side, you certainly see situations where parties involved in a transaction may feel like they could gain an advantage in that process by leaking information external externally to the media, whether it's to put pressure on another party, to try to take poll position, or something like that. We also see and and in our jobs where we may, try to work with a specific reporter within a day or so of an announcement to try to control, how a transaction is perceived by the market. And so we might actually work with a company to try to place a story with a reporter in the media in advance, which technically would count as a leak, but it's much more of a planned process trying to keep some control over how the market perceives your transaction.

On the unplanned side, there always are mistakes that happen. And and one answer to that that that sometimes is unpopular but is true is that M&A reporters are just very good at their jobs. They are really talented at assessing sources and assessing information and asking the right questions at the right time to the right people to piece together a story about a deal.

Nitin, let me come to you. There was a piece of research that Intralinks recently did, and it looked at data and discovered that actually the percentage of deals that are leaked has remained relatively stable over the last, few years.

Do we actually just have to accept that if you are doing an M&A transaction, leaks will happen? Is there actually any way that we can get rid of them completely out of the process? I think you ought to put this in pers perspective. Right? If you look at what deals generally leak, they are on the larger side and public side.

The number of deals, the percentage has skewed in the private side over the last five years or so. Right? So there's limited value in leaking them unless there is, malintent or sabotage or an accidental leak. The private capital markets are kind of the aggregate of those deals are higher than the public. Now in the public markets, I think Dan alluded to that perfectly that there are some intentional leaks.

The unintentional leaks are growing. And I think until there's education, it's impossible to take it to zero. And the impossibilities really stem from, third-party advisers not trained. You have a receptionist. You have social media people connecting with all kinds of investment bankers.

You can discern and put two out of two. Now one of the biggest challenges is that people in M&A are trained on the legal process and the fiduciary duties. They aren't really trained on cybersecurity. Right? And I can see all kinds of M&A software with people querying charge GPT for x y z things.

So that is that can all go into public databases. So it's like training and awareness can minimize it. I think the the net zero is like a singularity which may or may not be ever attained.

Matt, can I bring you into this conversation as well? Because Nitin there spoke about, you know, what's the value of a deal leak.

Can I first of all ask you on your take of that? You know, where do you think the value in leaking a transaction can come from? And let's spend some time talking about, confidentiality and how that can be maintained. But first of all, let's look back to that issue of value. Yeah.

From a value standpoint, I think there's, you know, there's a vast number of reasons that may, you know, may be the catalyst behind why somebody may choose to to to leak a deal or not. Again, I think it does go back to that intentional versus unintentional. But, you know, there are many, many reasons that that may may have sort of perceived value, whether it's to accelerate deal timelines. I think it's going to put pressure, on the deal to help force a quicker close. A lot of times, you know, according to the research that we've done with the Bayes School, that's actually been the opposite pace, and these leak deals, can actually then take longer because there's some mitigation strategies and and the time to kind of, you know, time to kinda clean all that stuff up.

But also there's value we've seen in the past in some of these larger leaks where, additional bidders can come in. So it may force attention to the deal. Somebody may think that that act that bid's undervalued, come in with a higher bid, and and drive some additional value that way. And, you know, maybe also, I think, generally, you know, to test sometimes the regulatory market. Right?

If you announce a deal or a deal leaks a little bit earlier and you start to get reactions from, you know, maybe not the regulators themselves, but from sort of the general populace about, oh, we don't know if that deal is going to actually get through, or come to fruition. I think it's a good the litigious test sometimes. Probably not the majority of the reason that deals are leaked, but definitely has happened. So you spent some time now talking about, you know, leaks and that they happen. The big question is, how do we avoid them?

How can we maintain confidentiality in an M&A process? Matt, can you talk to us a little bit about that, please? Yeah. I I I think, as they didn't mention, I think it's gonna be impossible to ever bring that to to zero. Right?

You're always going to have the, you know, person involved in a deal that's on an airplane reading a physical piece of paper and maybe somebody in in the middle seats looking over and sees that as happening and send sends out something on social media or somebody leaves a piece of paper in a cab. Those kind of mistakes, might always happen. But in terms of, you know, mitigating against leaks, I think it really comes down to the number of parties involved. And we've seen, you know, through our research that, you know, the number of parties over the last ten years involved in in these M&A deals has grown exponentially. And what's interesting is that leaks have not necessarily grown exponentially, but they're still they're still happening.

And I think controlling that, you know, initial group as much as possible, and making sure that everybody understands the impacts both, you know, primarily negative to elite, and has a really it keeps the deal team as small as possible for as long as possible because we've seen that, you know, as the time goes on throughout a deal, the group starts to expand and the potential for leaks goes up. Listen. Can I bring you into the conversation at this point and ask you to talk to me about what kind of key tools, key processes, in your experience, have helped maintain that confidentiality during an M&A process? Yeah. Absolutely.

And this is a common scenario that, especially in a public company deal, you kind of plan for but not hope for. Right? So one scenario is that we generally used to war game if it's a large deal. Right? What happens and then if this, this, that scenario?

It's like who leaks from where it leaks, what is the implication on capital markets, regulatory, and arguably now even nation states and sanctioned states given the political geopolitical landscape. Right? That said, you can put controls. One thing is to put a control, and the second thing is effectiveness of the control. Right?

So we generally use very tightly controlled VDRs. I think the governance process has to be very clear that you can't have them on spreadsheets and, all kinds of, skunk work, storage devices in x y z. Right? So that process has to be set in upfront on the governance. Eliminate general, logins, generic logins, print restrictions, stay against using unique watermarks.

I think you can also go to the other extreme and start to do, email metadata, which is, you know, a lot of us are trained to embed beacons, which is don't, target those emails. As Matt said, onboard vendors properly. And above all, all the deal people need to undergo security training and especially how to use the virtual data room. In my experience, the main problem is that if people aren't trained, right, they're not gonna change their behavior. If they don't know how to use a particular data room, they go and default into Excel and say, I'm gonna deal with this later.

So it's not only important to onboard them on the to the M&A process, the legality, the governance, the security also on the tools and technology. One of the biggest thing is that if I'm not familiar with the tool, I default to my old habit. So it's not like a big change management project, but that onboarding is pretty critical on what to do, what not to do, what to click, what not to click, who to invite, who not to invite. So if you generally put this ingrained into the onboarding of the people, I think it it does help a lot. Thank you very much.

Matt, I feel that I have to bring you in on this conversation as well. Talk to us from your perspective, from Intralinks' perspective. What specifically do you have in place to ensure that confidentiality? Yeah. You know, I I think with every good virtual data room and virtual data room hygiene and and goal management, ensuring, you know, the right people have the right access to the right content at the right time is absolutely great.

Right? You and and, you know, also setting up, you know, NDAs or even when you enter a data room, having to agree to, you know, a a specific splash page that has, you know, policies around what you could do with that content. I think, you know, there's not one single silver bullet, but I think there are a there are a number of, you know, small things that you can continue to put in place in layers that will help prevent deal leaks. And and it's interesting. You'd think that, you know, with the opening of a virtual data room, a small number of people or even a medium number of people, have now access to all this information around a deal, and you think there would be a correlation with the opening of a virtual data room with, you know, when leaks start to occur.

And and with our research, we found that that's not the case. The leaks usually occur, you know, far after almost two months after that virtual data room is open. So if you think maybe then as the deal starts to grow in size in terms of number of parties that are involved in the deal, that's likely the  causation there, but it it is not related to the opening of virtual data room. I think virtual data room is a key tool in really preventing leaks as long as it's used to grip. Thank you very much for your comments there, Matt.

We're gonna take a really short break. And after the break, we're gonna have a look at the unintended consequences and how to navigate those.

We're back. And Dan, I want to come to you now and give us an if you ask you if you can give us an oversight of the impact that a deal leak can have on the overall due diligence process and indeed the overall success of a transaction. Can you share some of your experiences with us? So leaks can have a very profound effect on the negotiation process, for a transaction, but also on how, the transaction is ultimately received by the market or stakeholders of of your company involved.

On one hand, you they can cause, the parties involved to press pause and delay, depending on reaction, that they hear. It can also have the opposite effect where, it can cause the parties to accelerate and really hustle to get a deal done. You see this especially, somewhat frequently in public company deals, depending on how a company stock reacts to rumors of a leak. That may cause the parties to to move quickly to get the deal signed. But it's also very true, and I think this is underappreciated that leaks can kill a deal process.

You we have we have absolutely seen situations where customers, employees, regulators have sent very clear signals to the company that they didn't like this deal so much so that company decided and the board decided, well, maybe this isn't the right time for this. So that is absolutely a factor that that can come into play. And, you know, when I think of where our seat and how we help companies through the communications and stakeholder engagement process, through transactions, one important fact is we've looked at media coverage at transaction leaks compared to the actual announcement. And the announcement is, of course, the time that the companies have prepared for. They've prepared this terrific messaging about the rationale and the great benefits of the deal, for all the stakeholders that matter.

They've that's gone through legal review and the board review, and it's ready for the public market. But the challenge is media pays so much more attention at the time of a leak. Our analysis found something like 300% more of, media volume happened at the leak versus at the announcement. And so the risk there is that, for companies whose deal gets leaked, the conversation about that transaction can happen without you. And so that's why it's really important to prepare in advance and be ready for the possibility of leaks.

Is that does that something have something to do with the fact that you don't have your narrative in place? You don't have your story in place. You don't have your facts and figures. And as you say, you're not actually the one controlling the narrative. So how much prep work, Dan, can a company actually do?

Because you don't really know when that leak is going to happen. You know, there's obviously points in time where, say, at the point where, the shortlist of bidders has been narrowed die down or someone has been taken into exclusivity. I mean, is it really as tricky as you're gonna have to just prepare that it might leak at any different at any time in the overall schedule and just have various game plans lined up and ready to go? That's exactly right. And usually at that point that you outlined is is the right point where we would work with companies to prepare what we call a leak scenario plan, which is essentially gaming out all the various ways that a leak could occur, whether it's through media, from other, perhaps, investors, from just a happenstance accident, customer employee chatter, for example, varying degrees of escalation and severity.

And then at each step along the way for those scenarios, what are the immediate steps the company needs to take? What can they say? What can they not say? And how can they manage through each scenario while communicating as best they can to the groups that matter most to the company. That can be a very complicated process.

If leaks happen through media, they happen very quickly. And so building that muscle memory in advance is really essential for companies to navigate through these scenarios the right way. So it's all about staying in control? Exactly. Perfect.

Thank you very much. Nitin, let me, bring you into the conversation, and let's talk a little bit about those unintended leaks. How can the consequences be mitigated, and how can the fallout be dealt with? What should companies have lined up? How should they prepare those next steps?

Yeah. I think look. Dan alluded to this a little bit. I think you have to reshape and rebuild the narrative. We've got to investigate the source, of the leak and kind of put a mitigation in place.

Right? And then there are these operational consequences, right, which is really either the if you look at the Qualcomm Broadcom deal, the regulatory thing kind of dragged that ever and the deal got killed. Right? Then I have seen mass executive defection after the deal. Right?

So you gotta sort of put, and then sometimes the value is in that management team and what they brought the company to. Right? So you gotta put some, measures there. Right? The second problem is that we we usually see if it's a deal is very large.

There is also another counter narrative that comes in on the breakup and the repricing of the deal. Right? That's actually pretty critical. It's kind of, challenging to defend share order value. So you almost have to rebuild the narrative or dismiss the narrative or change the narrative.

Right? And then, again, that depends on the deal and the deal leakage point and what the source is. But there are many, many reasons why this can happen at a strategic level. At a tactical level, then it has to get into the operations of the company and take a look at what can you do to protect the source and sustainability of the competitive advantage, be it in that executive team, certain projects, or certain locations, or whatnot? Matt, let me bring you in, and let's have a conversation around the topic of restoring confidence and what happens after a leak has happened.

Can you talk us through some of your experiences when it comes to that particular issue of a leak? How do we restore confidence after such, an event has taken place? I think first and foremost, at least between the deal parties, it comes back to restoring trust. Right? I think I think that that's that's critical.

And if you don't have that, then the deal is on on on uneven ground, shaky ground, and, you know, I think that the odds of that deal actually coming to fruition have significantly declined. So I think the focus really is in in in initially restoring trust between the deal party's confidence that, you know, the leak has been addressed. They identify where the leak came from, and they have processes in place to ensure that that doesn't happen again going forward. And then, you know, restoring that trust between the deal parties and also between the market as well. I think that's that's key.

And also just clarifying, you know, what the leak was, how it happened, what was exposed, if there is some confidential information that should not have been exposed. You know, getting out in front of it, I think, is key, and then getting proper protocols in place to move forward, from a place of is essential. We're almost out of time, so I would like to ask each of you to give me sort of your top three tips when it comes to the issue of dealing with leaks, but also how to maintain confidentiality during an M&A process. Dan, could I ask you for your top three, first of all? Absolutely.

I think first and foremost, number one, I would say is be prepared. Number two would be know the stakeholder groups that matter to your company and have a plan to reach them when you need to. And then number three is be flexible and nimble. Okay. Thank you very much, Nitin, from your perspective.

Top three, please. Okay. So I think one is be there that you are going from a user-generated leak era into a machine-generated leak era. Just ten minutes before the call, I was playing around with chat GPT. Everyone that's searching for every target and all that stuff, I could create a fairly okay blueprint in ten minutes.

Now I'm sure if I spend thirty minutes and sharpen my prompts, I'm gonna get a much better clearer picture on who's searching for what target, where. So beware that the era is shifting, and, it's no longer going to be linear damage. It's gonna be exponential damage and virality if you get your things into every LLM out there. Right? So the consequences can be damaging and much more faster.

I would say prepare for data leaks. Okay? It's, it's something that we don't want to, but war game the scenario and have a counter-narrative ready, have a sharpened narrative ready, and have your media outlets ready to go should this happen. Thank you very much. Matt, would you like to wrap us up on the topic of top 10, top three tips for preventing, leaks in an M&A process and how to prepare should they happen after all?

Yeah. Yeah. I think number one is great governance. Right? Were you involved in the deal and when is essential and being very intentional about that and and setting strict controls, you know, when you start to open a BDR and we start to initially share materials, ensuring that you're using, you know, the most secure, most trusted, vendors help there.

I think those are sort of my first two. And then and one may not be a tip, but an observation that we've worked through our research, actually. We've looked at deal leaks since 02/2009 in conjunction with the Bay school. We've also looked at deal leaks, with a cross-section of of how gender diverse is the executive teaM&And the board, in particular. And we found that there's a significant correlation between more gender diverse boards and less deal leaks.

So, you know, maybe that's a tip. Add some gender diversity to your board, but we've definitely seen a correlation in the data, which is which is quite interesting. Nissan, do you want to respond to that? No. I was saying that it's not only humans part of the deal now.

Machines are also part of the deal now. Right? Matt, do you think we count the machines as part of the diversity as well? I I suppose so. I don't know which gender we shoot then, but we're all kidding.

Great. Thank you very much to all of you. That's all that we have time for in today's episode, The Dealist. I'm sure all of you listeners will join me in thanking Dan, Matt and Nitin for sharing their insights into how to deal with confidentiality and leaks in an M&A process. If you found this podcast valuable, please subscribe wherever you get your podcasts, and share us with your colleagues in the industry.

Join us for our next podcast. And until, thank you very much for listening, and goodbye.