News (All)

By Christine Malafi

With major data and security breaches consistently making headlines, a thorough investigation of a target company’s security practices is critical to a buyer’s decision to purchase a company. Areas of examination include operational assets, financial data, legal matters, strategic planning, and employee information. Such assessments help potential buyers manage and alleviate risk, liability, and exposure before pursuing a precarious deal. Unfortunately, cybersecurity is often overlooked in the frenetic pace of M&A transactions.

Failure to exercise proper due diligence in M&A transactions can result in costly mistakes. Just consider recent headlines: FedEx had customer data, including scanned passports and driver’s licenses, stolen from a publicly accessible server. FedEx obtained the server when it purchased Bongo International to help customers with shipping calculations. This breach highlights the importance of auditing digital assets to ensure data is secure before, during, and after an acquisition. Cybersecurity concerns may decrease the purchase price or result in a holdback of payments until claims are resolved.

This is precisely the scenario that played out in Verizon’s renegotiation of the Yahoo acquisition after details emerged that three billion Yahoo accounts were hacked. The news prompted a reported reduction of $350 million in the purchase price.  In 2017, Neiman Marcus agreed to pay $1.6 million as part of a proposed settlement of a consumer class action lawsuit, originating from a 2013 data breach which allegedly exposed the credit card data of more than 350,000 customers. And in August 2017, Women’s Health Care Group of PA, LLC experienced the third largest data breach of the year after completing a merger. These examples are only the tip of the iceberg, as nearly 182 million records have been exposed in the first half of 2018 alone.

To minimize the risks, target companies must have written data security policies – and enforce them – to maintain the highest company value. Potential acquirers must conduct targeted cybersecurity due diligence to determine whether a transaction should proceed by assessing all past and present versions of the target’s information security policies. Acquirers should also evaluate how to seamlessly migrate data and technology from the target company without exposing the information. The due diligence process can provide the acquirer with an estimate as to the costs needed to remediate.

A preliminary inquiry should also address data losses the target company has sustained. The acquiring company should uncover any systemic security failings, determine how the target company has responded to cybersecurity incidents, and assess whether the target company remains vulnerable.

The next area of inquiry is whether the company is a high-risk target. The due diligence team will need to determine the scope of client/customer data on the target company’s servers. This inquiry is especially pertinent to high profile mergers. A prospective buyer will also want to assess a target company’s governance. Questions to ask should include: what is the current state of the target company’s cybersecurity program, policy, procedures, compliance, and enforcement? How does the target company manage its IT security?  Are employees trained to recognize cybersecurity threats?  Is the target proactive in preventing breaches, detecting malware, updating security certificates, storing information, and protecting its assets?

The acquiring company must also research the target company’s regulatory and compliance obligations. The type of business is important: banking, financial, and healthcare institutions are highly regulated with respect to safeguarding information. These types of businesses often store information widely sought after by hackers. Additionally, companies regulated by the New York Department of Financial Services are subject to the agency’s new cybersecurity regulations and reporting obligations, which can be both time-consuming and costly. It may also be valuable to investigate industry standards to determine if a target company’s safeguards fall within commercially reasonable requirements. It is best practice for an acquirer to gain a complete picture of any additional compliance and regulatory burdens assumed in a deal.

Finally, due diligence should look at the security of the computing infrastructure, vendor or third-party relationships, employee training, and the social media presence and policies of the target. These areas can help determine whether the target company is at a greater cybersecurity risk. A company’s network is only as secure as its weakest link, and any outsourcing of security or IT services can open a back-door into systems.

The more efficient a company’s cybersecurity response protocol, the less risk will be assumed by the acquirer.

In a world where cybersecurity incidents are ubiquitous, cybersecurity due diligence must be part of any good M&A checklist. Companies should integrate specialized cybersecurity teams, including counsel, into their due diligence process to ensure they are asking the correct questions. Carefully reviewing a target company’s cybersecurity posture not only identifies potential risks, but can also justify specialized representations and warranties to be included into purchase agreements to protect the value of an investment.

In the world of M&A, each party to a purchase agreement makes certain representations and warranties that serve to allocate risk between the parties and provide a basis for post-closing indemnification obligations. Although often used interchangeably, there are functional differences between a representation and a warranty. A representation is an assertion of past or existing fact given by one party to induce another party to enter into an agreement. A warranty is a promise that the assertion of existing fact or future facts are or will be true, along with an implied promise of indemnity if the assertion is false.

Representations and warranties are often heavily negotiated areas of an agreement. The number and nature of representations and warranties are specific to each party, the nature of the contract itself, and the subject matter of the contract or dealings.

A seller’s representations and warranties serve several related purposes. They serve as a disclosure about the seller and the seller’s business as of a specific date, give important information about the stock or assets being sold, provide a basis for the buyer’s right to terminate before or at closing, and affect the buyer’s right to indemnification by the seller and/or its principals. Representations and warranties could favor either a buyer or a seller depending on several factors including each party’s negotiating power, the nature of the transaction, and the trade in which the parties operate.

Standard representations relate to due organization, valid existence and good standing, power and authority to operate the business and to enter into the agreement, and compliance with laws. Other representations and warranties relate to the subject matter of the agreement, such as title to assets, liens and encumbrances, intellectual property rights, taxes, and litigation. Rather than omitting representations and warranties in their entirety (which will likely raise red flags to the other side), a seller should attempt to qualify its representations and warranties. This can be accomplished in a number of ways.

For instance, because it is not always possible to account for every single item that should be listed in an agreement, a seller may attempt to limit representations and warranties to apply only to things and matters that are “material” and to add “knowledge” standards to limit the statement of fact to things that the seller actually knows of or should have known of. Another option is to limit representations and warranties to apply only to certain time periods (e.g., “within the past three years”). Most importantly, a seller should disclose as many exceptions to facts or conditions that are inconsistent with the general statement of fact made in any corresponding representation or warranty. This reduces the potential for future claims of breach of representations and warranties based on non-disclosure of material conditions. A combination of the concepts above can be proposed by the seller as well. For example, “[e]xcept as set out on Schedule X.XX, there are no pending, and to seller’s knowledge, threatened lawsuits, actions or other proceedings or governmental investigations relating to the [s]eller’s properties or business” could be added to a representation and warranty involving litigation and other actions to avoid making an absolute statement of fact.

On the other hand, a buyer wants the seller’s representations and warranties to be unqualified and as broad as possible. Broader representations and warranties often requires a seller to disclose more information during contract negotiations and due diligence and can provide a greater foundation for buyer’s termination and indemnification rights in the event of a post-closing breach. Disclosure schedules are also utilized by the buyer as they can require a seller to list out certain important business items, such as required permits, third-party consents, and employee benefit and compensation information. By requiring the seller to list out these types of items, the buyer can utilize the disclosure schedules as a checklist of items to be tracked and completed leading up until closing. When signing and closing are not on the same day, a buyer will look to insert a “bring down” condition of the representations and warranties to ensure that the seller’s representations and warranties made as of the signing date are true and accurate as of closing date.
Representations and warranties can be as complex or as simple as agreed upon by the parties but, more often than not, they are the legal basis for the parties’ willingness to complete an M&A transaction.

Our legal team has a depth of experience in structuring M&A transactions on both the buy-side and sell-side across a variety of industries, including healthcare, technology, real estate, and retail. Learn more on our Mergers and Acquisitions page.

“Choice-of-law” provisions, identifying which state’s laws a contract will be interpreted under, are almost universally found in contract “boilerplate.” Businesspeople anxious to get deals done typically focus their attention on the up-front-and-center contractual provisions detailing the terms of the deal, not the boilerplate language concerning jurisdiction, venue, choice-of-law, and other unexciting provisions stuck in at the end, almost like an afterthought. But a recent decision from New York’s Court of Appeals, 2138747 Ontario, Inc. v. Samsung C & T Corporation,[1] reminds businesses and lawyers alike that every single term in a contract – no matter how unimportant it may seem during the drafting process – merits careful consideration before the parties sign.

In Ontario, the issue was the choice-of-law provision – in particular, whether a choice-of-law provision in a contract between non-New York litigants providing that the contract was to be “enforced” under New York law required straightforward application of New York’s six-year statute of limitations for breach of contract actions,[2] or instead whether the “borrowing statute”[3] should be applied.  The borrowing statute of CPLR 202 provides that New York non-residents may bring claims pertaining to causes of action that accrue outside New York only if the action would be timely under both New York and the home jurisdiction’s statute of limitations.

By way of background, most choice-of-law provisions direct a court to apply the substantive law of the chosen state (essentially, laws that concern a litigant’s rights). However, in Ontario, because the provision at issue provided that the contract would be “enforced” according to New York law, the litigants agreed that New York procedural law would also apply (essentially, the law that governs conduct in the courtroom). Rules regarding statutes of limitations – which set the time period within which a litigant may prosecute a claim – are generally considered by New York courts to be procedural.

Against this backdrop, the issue in Ontario was this: since the contract specified that New York procedural law would apply, how should the court reconcile two conflicting procedural rules? Should it enforce the six-year statute of limitations as it would if the breach concerned New York parties? Or should it find a lawsuit timely only if it was timely under both New York and the home jurisdiction’s statute of limitations (pursuant to the borrowing statute)?

Ultimately, the Ontario court ruled that the borrowing statute applies, requiring the claim to be timely in both venues, in part because it was in direct contrast to the long-standing common law rule that the procedural law of the venue controls. In other words, if the legislature upends long-standing legal traditions by statute, a reviewing court must consider that break to be principally important, and should uphold its legal effect.
Notably, the Ontario court explicitly did not address what the effect would be if the parties had expressly provided that the contract would be subject to New York’s six-year statute of limitations, and left open that such a provision might run afoul of CPLR 201, which generally prevents elongation of statutes of limitation by contract.

The takeaway from this case? If you are a non-resident contracting to perform services outside of New York, and your contract stipulates that New York procedural law applies, be aware that you swallow that procedural law whole, and may be unable to contract around your home jurisdiction’s shorter statute of limitations. And more broadly, this case serves as an important lesson. It’s often the provisions that seem the most innocuous during drafting that can cause the biggest headaches later.

[1] 31 N.Y.3d 372.
[2] CPLR 213(2).
[3] CPLR 202.