Managing cybersecurity risks across private equity firms’ portfolio companies

Many ransomware attacks use a double extortion tactic. This is when the perpetrator steals information, encrypts it, and threatens to sell or release the information to the public if the ransom isn’t paid. Unfortunately, many attackers are in safe havens and can easily avoid prosecution from Canadian authorities.

The other major threat is business email compromise. One of the most common scams are false invoice or impersonation schemes. For example, the threat actor will take control of an employee account to change the information for invoice payments. Or they may impersonate a vendor or business partner, which results in fraudulent transactions.

While every company is a potential target for a cyber threat, some portfolio companies may face more threats than others. In 2022, the Canadian Anti-Fraud Centre noted the five most impersonated sectors were governments, delivery agencies, retail, health, and finance.

A company’s cybersecurity risk profile will be affected by the industry in which they operate, the type of sensitive data they collect and store, and the intellectual property they own. Companies that support governments (federal, provincial, or municipal) as a client are typically more highly targeted.

PE firms’ portfolio companies or the companies they plan to buy might not have a cybersecurity strategy or a robust program in place to manage cyber risk. High risk can be introduced if cybersecurity due diligence is not performed. 

Not all portfolio companies are created equal, nor are their associated cyber risk profiles. Right sizing assessment methodologies and mitigating actions are key to ensure the most value is achieved through security efforts.