Latest / The Acquisition Talk with Fexingo: Mergers, Buyouts, and Business Sales for Operators / The Data Room Leak That Sank a $75 Million Deal
Transcript
- Lucas: So Luna, we're at episode 150, and I've got a fresh one that I think is going to sting a little, especially for anyone who's ever run a sell-side process. Luna: I'm braced. After 149 episodes of traps, I know the pattern: someone leaves a door unlocked, and it costs them millions. Lucas: Exactly. And this time the door is digital. I'm talking about a data room leak that sank a seventy-five million dollar deal. Let's set the scene. A mid-sized software company with strong recurring revenue, clean books, and a strategic buyer who was ready to sign in two weeks. Luna: That's the dream scenario. So what went wrong? Lucas: The seller's investment bank had set up a standard virtual data room—think of it as a secure cloud folder with granular access controls. They had about thirty viewers: the buyer's team, their lawyers, their financial advisors. All signed NDAs. But here's the kicker—one of the buyer's senior analysts had been in a bidding war for a similar company a year earlier, and that competitor's CFO had access to this same data room as an advisor on the other side. Luna: So you're telling me the data room software didn't flag that a viewer from a competing bidder had access to the same files? Lucas: It didn't. The seller's team never ran a conflict check on the email domains or the individual users. And because the buyer's analyst had forwarded a couple of documents to a personal email—which is a red flag in itself—the competitor's CFO got a look at the seller's pricing model and two key customer contracts. That was enough. Luna: And by 'enough,' you mean the competitor used that intel to poach the customer and undercut the price, right? Lucas: Worse. They went to the seller directly and said, 'We know you're selling to our competitor. We'll offer you a lower deal but we'll also launch a lawsuit against your buyer for misappropriation of trade secrets.' The buyer walked. The seller was left with a tainted process and a lawsuit threat hanging over them. The deal collapsed, and the seller eventually had to go through a second process months later, at a valuation that was, let's say, significantly south of seventy-five million. Luna: That's brutal. And it all comes down to a data room that wasn't monitored properly. I guess it's a reminder that in M&A, the intangible assets are often the most valuable—and the most fragile. Lucas: Absolutely. And it's exactly why I love doing this show. These are the stories that don't make it into the headlines, but they're the ones that keep operators up at night. And if these conversations have helped you sharpen your own deal process, even a little, that's the reason we keep doing it ad-free. If you want to support the show, you can buy us a coffee at buy me a coffee dot com slash fexingo. It's a small gesture that goes a long way in keeping these episodes coming. Luna: And we genuinely appreciate it. It's listeners like you who keep us going. Alright, back to the data room. So what's the practical takeaway here for a seller? I'm guessing it's not just 'use a better software.' Lucas: Right. It's about process. First, run a conflict check on every single data room user—not just the company, but the individuals. Check email domains, LinkedIn histories, prior deal involvement. If a name shows up on both sides of a previous deal, that's a flag. Luna: And I assume that's where NDAs come in, but NDAs alone don't stop a determined insider. You need technical controls. Lucas: Exactly. Watermark every document with the viewer's name and email. That way, if a PDF leaks, you know exactly where it came from. And use dynamic watermarks that update with the time and date—that's a deterrent in itself. Luna: But what about the buyer's side? They're the ones who caused the leak in this story. Is there a way they can protect themselves from being blamed? Lucas: That's a great point. Buyers need to have their own internal policies about data room access. The analyst who forwarded documents to a personal email—that's a violation of the buyer's own cybersecurity policy, and it should have been caught before it ever happened. Buyers should also consider restricting the number of people who have access to the most sensitive documents, like pricing models or customer contracts. Instead of giving everyone full access, you can tier the data room. Luna: Tiering makes sense. You give the senior team the full picture, but the junior analysts only see what they need for their part of the diligence. That's a simple but effective safeguard. Lucas: And it's not just about confidentiality. It's about negotiation leverage. When I advise buyers, I tell them to use data room access as a bargaining chip. You can say, 'We'll grant access to the full data room once we've agreed on the key terms.' That puts pressure on the seller to move on price and structure. Luna: That's a clever tactic. But from a seller's perspective, isn't that frustrating? You want to show the value of your company, but you're also exposing your crown jewels. Lucas: It's a delicate balance. The seller needs to share enough to justify the valuation, but they should also have a clear exit strategy for the data room. For instance, you can revoke access to certain documents once the LOI is signed, or you can put a time limit on the data room itself. And you should always have a plan for what happens if the deal falls through—you want to make sure those files are returned or destroyed, and that's something you can put in the NDA from the start. Luna: So it's not just about the technology; it's about the legal framework and the operational discipline. But in this story, the leak wasn't from a third party—it was from the buyer's own analyst. How do you prevent that? You can't control the buyer's internal behavior. Lucas: You can control the consequences. The seller's NDA should have a clause that specifically addresses unauthorized forwarding or sharing of documents, with clear penalties—not just for the buyer, but for the individual who leaks it. And the NDA should survive the deal, so even if the transaction closes, you can still sue for damages if the information is used improperly. Luna: And in this case, the seller didn't have that clause, so they were left without recourse against the analyst personally, right? Lucas: Exactly. They had a generic NDA that the buyer's counsel signed, but it didn't extend to individual users. So when the analyst forwarded the documents, the seller couldn't go after him directly. They could only go after the buyer company, and the buyer company's response was to walk away from the deal. Luna: So the seller was left holding the bag. It's a stark reminder that the data room isn't just a folder on the cloud—it's a negotiation and a risk management tool. Lucas: And it's not just about the documents you put in the data room. It's about the meta-data. In this story, the competitor also saw the access logs—they could see which documents the buyer had viewed and how often. That gave them insight into what the buyer was most interested in, which they used to craft their offer to the seller. Luna: Wow, that's next-level espionage. So even the access logs themselves are sensitive information. Lucas: Absolutely. I always advise sellers to limit the number of people who can see those logs, and to keep them confidential. That's part of the data room security plan. And you should also be careful about what you name your files—don't put 'customer contract' in the file name if it's actually a pricing model. That kind of sloppiness is how leaks happen. Luna: It's like leaving a trail of breadcrumbs. And I suppose this also affects the buyer's due diligence process. If they're worried about leaks, they might be more cautious about what they request. Lucas: Yes, and that can create friction. But it's better to have that friction upfront than to have a deal collapse later. I've seen buyers walk away from deals because the data room was too disorganized or too insecure. It's a red flag about the seller's overall management quality. Luna: So for our listeners who are thinking about selling their business, what's the one thing they should do this week to protect themselves? Lucas: Run a full audit of your current data room, if you have one. Check who has access, what they've downloaded, and whether you have watermarks in place. If you don't have a data room yet, start with a clean slate—use a reputable provider that gives you granular control, and set up strict access protocols from day one. It's an investment, but it's a fraction of what a leak could cost you. Luna: And for buyers, I'd say be vigilant about your own team's behavior. The analyst in this story probably thought they were just doing their job, but they cost their company a deal and themselves a career. Lucas: That's the human element. Which brings me to another point: it's not just about technology, it's about culture. In this case, the analyst worked for a buyer that didn't have a strong culture of data security. They were in a rush to close, and so they cut corners. That's a warning sign for both sides. Luna: So it's about creating an environment where people understand the stakes. I think that's a perfect note to end on—because it ties back to the human factor that we always say is at the heart of M&A. Lucas: It is. And as we celebrate episode 150, I think that's the lesson worth remembering: in the end, deals are closed by people, and people make mistakes. The best you can do is to build systems that catch those mistakes before they become catastrophic. Luna: Here's to 150 more episodes of catching those mistakes, Lucas. Thanks for digging into this one. Lucas: Thanks, Luna. And thanks to all our listeners for supporting the show. We'll be back next week with another story, and hopefully one that doesn't end in a walk-away.