Breach Due Diligence: What to Ask Before Investing

Breach due diligence is the part of an investment or acquisition review that asks what a company's past and present security exposure will cost the buyer after closing. Before the money moves, an investor or acquirer should ask what incidents have happened, how they were found, who has access to what, and which vendors hold the data.

The reason to ask before signing is simple: the record shows breaches get repriced, fined, and disclosed after deals close. A company that cannot answer these questions cleanly is telling you something about how it runs, and that is worth knowing at the term sheet stage rather than in the first board meeting.

Why does breach due diligence change the price of a deal?

The clearest public example is Yahoo. On February 21, 2017, Verizon and Yahoo announced that the purchase price was being reduced by $350 million after Yahoo's data breaches, leaving the deal valued at approximately $4.48 billion against an original price of about $4.83 billion. The revised terms also split future costs: Yahoo would bear half of certain post-closing cash liabilities from non-SEC government investigations and third-party litigation, and all liabilities from shareholder suits and SEC investigations. The breaches also would not be taken into account in deciding whether a material adverse effect had occurred.

The cost did not stop at the price cut. In April 2018 the SEC ordered Altaba, the entity Yahoo became, to pay a $35 million civil penalty for failing to disclose the 2014 breach. The same order ties the $350 million price reduction directly to Yahoo's disclosure of the 2014 breach.

Read together, the two documents show where diligence pays off. A breach found before signing becomes a negotiated term. A breach found after signing becomes a dispute, a penalty, or both. The broader cost picture is covered in the cost of cyber resilience versus breach recovery and fines.

What happens when you acquire a breach you did not know about?

Marriott acquired Starwood in September 2016. Starwood's systems had been compromised in 2014, and the attack was not detected until September 2018. The UK Information Commissioner's Office later issued a final penalty of £18.4 million on October 30, 2020. The Penalty Notice cites Marriott's own estimate of 339 million guest records affected.

Two details matter for anyone buying a company. First, the intrusion predated the acquisition by two years, and the buyer still carried the regulatory consequence. Second, the ICO made no infringement finding for the period before GDPR took effect on May 25, 2018. The rules in force while the intrusion was running, and the period the regulator can reach, shape what the buyer inherits.

For a buyer, diligence has to cover the systems being acquired, including the ones nobody has looked at in years. Most targets will not be hiding an intruder, but the review should be built to find one if it is there. That is the same discipline as due diligence on technology vendors, applied to a company you are about to own.

What disclosure rules apply if the acquirer is a public company?

Since 2023, SEC registrants have had to disclose material cybersecurity incidents on Form 8-K under Item 1.05. The SEC's announcement of the rule says the disclosure is generally due four business days after a registrant determines the incident is material. The clock starts at the materiality determination, not at discovery, and delay is allowed only if the US Attorney General finds disclosure would pose a substantial risk to national security or public safety.

Public companies also describe their cybersecurity risk management and board oversight annually in Form 10-K under Regulation S-K Item 106. Once a target is folded in, its processes become part of what the acquirer describes in that filing.

What should an investor ask before the money moves?

The useful questions are about systems and vendors, because that is where the exposure sits. They do not require a penetration test to answer, and they are often more revealing than one, because they test whether the company knows its own estate. Seven to start with:

• What incidents have you had, and how were they found? Found by the company's own monitoring is a different answer from found by a customer, a bank, or a reporter.
• Where does personal and customer data live? Ask for the inventory, not a description. If it does not exist, that is the finding.
• Which vendors can reach that data? Every payroll provider, cloud host, and support contractor is part of the exposure, which is the point of the sub-processor problem.
• Who holds administrator access, and how is it removed when people leave? Shared admin logins and former staff with live accounts are common and fixable.
• How are payment and bank detail changes verified? The answer tells you how exposed the company is to business email compromise.
• What breach notification obligations apply? Massachusetts residents, EU customers, and regulated data each bring their own. GDPR for Massachusetts companies covers one of the less obvious ones.
• What would the cyber insurer refuse to pay? The exclusions in the policy are a map of the gaps, as covered in cyber insurance exclusions that decide claims.

How much is breach exposure worth in the model?

IBM's 2026 Cost of a Data Breach report puts the global average cost at $4.99 million, based on 602 organizations with breaches between March 2025 and February 2026. The mean time to identify and contain a breach was 247 days. In the United States, the report puts the average at $11.5 million, more than twice the global figure.

Those are averages across organizations of every size, so they are a reference point, not a valuation input. What they do show is that the cost is large relative to the price of a lower-middle-market deal, and that the average breach runs for months before anyone contains it. A company that discovers something during diligence is in a far better position than one that discovers it 247 days after closing. What happens when you get hacked walks through what those months look like inside a business.

For operators preparing to raise or sell, the same questions work in reverse. Answering them before a buyer asks shortens diligence, and a clean data inventory with documented vendor contracts is one of the few security assets a buyer can actually inspect. Vendor contract exit terms are part of that file, because a buyer will want to know what it takes to move off each system.

At Kief Studio we build systems where the data inventory, vendor access, and admin controls are part of how the platform runs, so the answers to these questions exist before anyone asks for them. We also help operators and investors work through vendor and systems due diligence ahead of a raise or a sale; the consulting page covers how to reach us. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side. This is general information, not legal or investment advice.

Related reading

• The cost of cyber resilience versus breach recovery and fines
• Due diligence on technology vendors
• The sub-processor problem
• GDPR for Massachusetts companies

Frequently Asked Questions

What is breach due diligence?

It is the part of an investment or acquisition review that examines a company's security incidents, data inventory, vendor access, and disclosure obligations, so the buyer understands what exposure it is taking on before closing.

How much did the Yahoo breaches reduce the Verizon deal?

Verizon and Yahoo announced a $350 million price reduction on February 21, 2017, leaving the deal valued at approximately $4.48 billion. The SEC later fined Altaba $35 million for failing to disclose the 2014 breach.

What was Marriott's final fine for the Starwood breach?

The UK ICO issued a final penalty of £18.4 million on October 30, 2020. Marriott acquired Starwood in September 2016, and the attack on Starwood's systems was detected in September 2018.

Does a buyer need a penetration test to do breach due diligence?

Not to start. The most revealing questions are about data inventory, vendor access, admin accounts, incident history, and how payments are verified. Technical testing can follow once those answers are in hand.