--- title: Disclosing Cyber Risks description: This post explains why companies should be more vigilant in the merger and acquisition process to assess the cyber risk of an acquisition target. image: https://blog.axisins.com/hubfs/Imported_Blog_Media/Professional-Liability-Risk-Management-Steps-for-Employers-to-Follow-300x277.jpg --- [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) Connect with us Call us Today [(201) 847-9175](tel:2018479175) [(877) 787-5258](tel:8777875258) - - About Axis - [Our Approach](https://www.axisins.com/about-us/) - [Our Team](https://www.axisins.com/our-team/) - [Testimonials](https://www.axisins.com/testimonials/) - [Case Studies](https://www.axisins.com/case-studies/) - [News & Events](https://blog.axisins.com/tag/news-and-events) - [Careers](https://www.axisins.com/job-opportunities/) - Product Lines - [Overview](https://www.axisins.com/products/) - [On-line Quoting](https://www.axisins.com/products/on-line-quoting/) - [Surety Bonds](https://www.axisins.com/products/surety-bonds/) - [Cyber Liability/Privacy & Network Security](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Overview](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Why Cyber Liability](https://www.axisins.com/products/cyber-liability-privacy-network-security/why-cyber-liability/) - [Cyber Hotline/Resources](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) - [Claims Scenarios](https://www.axisins.com/products/cyber-liability-privacy-network-security/claims-scenarios/) - [Professional Liability Insurance (E&O)](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Overview](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Professions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/professions/) - [Insurance](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/insurance-agents-brokers/) - [Legal](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/legal/) - [Real Estate](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/real-estate-agents-brokers/) - [Technology](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/technology/) - [Healthcare/Medical](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/healthcare-medical-practice/) - [Architects & Engineers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/architects-engineers/) - [Financial Institutions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/financial-institutions/) - [Construction](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/construction/) - [Consulting](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/consulting/) - [Media](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/media/) - [Mortgage Bankers & Brokers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/mortgage-bankers-brokers/) - [Miscellaneous Services](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/miscellaneous-services/) - [Resources](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/resources/) - [Claims Scenarios](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/claims-scenarios/) - [Management Liability Insurance (D&O)](https://www.axisins.com/products/management-liability-insurance-do/) - [Overview](https://www.axisins.com/products/management-liability-insurance-do/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/management-liability-insurance-do/claims-scenarios/) - [Resources](https://www.axisins.com/products/management-liability-insurance-do/resources/) - [Employment Practices Liability Insurance](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Overview](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/employment-practices-liability-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/employment-practices-liability-insurance/resources/) - [Crime Insurance](https://www.axisins.com/products/crime-insurance/) - [Overview](https://www.axisins.com/products/crime-insurance/) - [Claims Scenarios](https://www.axisins.com/products/crime-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/crime-insurance/resources/) - [Fiduciary Liability](https://www.axisins.com/products/fiduciary-liability/) - [Overview](https://www.axisins.com/products/fiduciary-liability/) - [Claims Scenarios](https://www.axisins.com/products/fiduciary-liability/claims-scenarios/) - [Resources](https://www.axisins.com/products/fiduciary-liability/resources/) - [FAQs](https://www.axisins.com/faqs/) - Client Resources - [Make a Payment](https://axisins.epaypolicy.com/) - [Apps & Forms](https://www.axisins.com/client-resources/apps-forms/) - [Report A Claim](https://www.axisins.com/client-resources/report-a-claim/) - [Request A Certificate of Insurance](https://www.axisins.com/client-resources/request-a-certificate-of-insurance/) - [Blog](https://blog.axisins.com/) - [Contact Us](https://www.axisins.com/contact-us/) -   CALL US TODAY [(877) 787-5258](tel:8777875258) ## Keeping you up to date on trends, emerging exposures and other critical issues. [Subscribe To Our Blog](https://share.hsforms.com/18qZLml0MTSqtYWBFqQFAGA35dv4?__hstc=172306556.605fbd816f522e1de3e9428cb969d5b4.1580877711545.1580973215492.1580978435349.10&__hssc=172306556.3.1580978435349&__hsfp=1035641285) # Disclosing Cyber Risks April 4, 2019 ![](https://blog.axisins.com/hubfs/Imported_Blog_Media/Professional-Liability-Risk-Management-Steps-for-Employers-to-Follow-300x277.jpg) Drew Smith   ![Professional-Liability-Risk-Management-Steps-for-Employers-to-Follow-300x277](https://blog.axisins.com/hs-fs/hubfs/Imported_Blog_Media/Professional-Liability-Risk-Management-Steps-for-Employers-to-Follow-300x277.jpg?width=678&name=Professional-Liability-Risk-Management-Steps-for-Employers-to-Follow-300x277.jpg)  When a [Cyber](https://www.axisins.com/products/cyber-liability-privacy-network-security/) breach occurs, a company is required to disclose and report the extent of the breach, individuals affected and its steps to mitigate exposure to regulators, employees, affected individuals and other stakeholders to an organization.Many companies have an inordinate amount of time to investigate breaches and potential breaches thus exposing affected individuals to even more risk. Equifax realized they were breached on July 29, 2017 but did not report the matter until September 7th. Marriott disclosed their breach on November 30, 2018, however it took three months before revealing they were breached by a bug that should have been disclosed. Additionally, the disclosure revealed their customers data had been available since 2014 when they purchased. The Marriott breach revealed disclosure issues that needed to be seriously addressed.[\[1\]](https://blog.axisins.com/disclosing-cyber-risks#_ftn1) This exposes a risk to any acquiring company of potential hidden risks in an M&A transaction. The risk associated with the hack came from when Marriott bought out the Starwood chain. That chain had been hacked in 2015 and thought they cleared it, unaware of a second more dangerous virus left behind. They did not disclose this to Marriott in the buyout proceedings.[\[2\]](https://blog.axisins.com/disclosing-cyber-risks#_ftn2) The Marriott breach specifically revealed disclosure in an M&A transaction. When they purchased Starwood Hotels they had not contemplated this exposure. Further, was there even a requirement on behalf of Starwood to disclose this issue at all. Among the investigation report from this breach, four issues stand out: 1. Inadequate Disclosure: Current disclosure rules are at best vague guidelines from the Securities and Exchange Commission (SEC). The SEC doesn’t have specific guidance in place to require any company to disclose a breach, which explains 2. Cost Cutting during Mergers: The evidence in the Marriott breach point to the Starwood Hotels systems and not Marriott as the source of the breach as they had a smaller scale hack before being bought out. Consistent with many mergers, most of the top level staff were terminated including those in IT and cyber security. Many suggest that in mergers they should disclose to the buyer if they ever had a breach. 3. Better Expertise on Boards: Most boards including Marriott’s have little to no experience on cyber security; hence they have to rely on outside experts. In the future, many are expected to hire those with experience in this.[\[3\]](https://blog.axisins.com/disclosing-cyber-risks#_ftn3) Companies should be more vigilant in the merger and acquisition process to assess the cyber risk of an acquisition target and the government should continue to enhance legislation and regulation to force companies to disclose all potential breaches and risks in a timely and consistent manner.   [\[1\]](https://blog.axisins.com/disclosing-cyber-risks#_ftnref1) [https://hbr.org/2019/03/the-marriott-breach-shows-just-how-inadequate-cyber-risk-disclosures-are](https://hbr.org/2019/03/the-marriott-breach-shows-just-how-inadequate-cyber-risk-disclosures-are) [\[2\]](https://blog.axisins.com/disclosing-cyber-risks#_ftnref2)  [https://www.insurancejournal.com/news/national/2018/12/03/510811.htm](https://www.insurancejournal.com/news/national/2018/12/03/510811.htm) [\[3\]](https://blog.axisins.com/disclosing-cyber-risks#_ftnref3) [https://hbr.org/2019/03/the-marriott-breach-shows-just-how-inadequate-cyber-risk-disclosures-are](https://hbr.org/2019/03/the-marriott-breach-shows-just-how-inadequate-cyber-risk-disclosures-are) [Email Compromise: What it Is, and How To Protect Your Business](https://blog.axisins.com/email-compromise-what-it-is-and-how-to-protect-your-business) [Small Businesses: Be Wary of These Common Scams](https://blog.axisins.com/small-businesses-be-wary-of-these-common-scams) Search ### Share this post [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/x-twitter-color.png?width=24&name=x-twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Fdisclosing-cyber-risks%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Recent Posts ### Categories - [E&O (19)](https://blog.axisins.com/tag/eo) - [Cannabis (11)](https://blog.axisins.com/tag/cannabis) - [Company News (1)](https://blog.axisins.com/tag/company-news) ![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/art2.png) ### Connect to Our Cyber Hotline & Resources [Connect](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) Please see our [Privacy Policy](https://www.axisins.com/privacy-policy) to understand how Axis Insurance Services handles your personal information. California Residents are entitled to specific rights which can be outlined on our Notice for [California Residents](https://www.axisins.com/california-privacy-policy). You may request information regarding our privacy policy or update your preferences by contacting us directly at 201-847-9175 or by completing the Request for Information on [Privacy form](https://info.axisins.com/axis-request-for-information-on-privacy). ### Schedule a Consultation ### Stay tuned with us on social networks! [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) 795 Franklin Avenue, Suite 210 Franklin Lakes, NJ 07417 Phone: [201-847-9175](tel:2018479175) Fax: 201-847-9174 [www.axisins.com](http://www.axisins.com/) ### Quick Navigation - [Home](https://www.axisins.com/) - [About Axis](https://www.axisins.com/about-us/) - [FAQs](https://www.axisins.com/faqs/) - [Blog](https://www.axisins.com/blog/) - [Site Map](https://www.axisins.com/site-map/) - [Contact Us](https://www.axisins.com/contact-us/) - [Privacy Policy](https://www.axisins.com/privacy-policy/) - [Terms & Conditions](https://www.axisins.com/terms-conditions/) - [Accessibility Statement](https://www.axisins.com/accessibility-statement/) - [State Licenses](https://www.axisins.com/state-licenses/) Copyright ©2022 – 2024, Axis Insurance Services, LLC In California and Texas as NJ Axis Insurance Services, LLC. In Illinois as Axis Insurance Services of New Jersey, LLC. In New York as NJ Axis Insurance Agency New Jersey Corporate License #OP-9948294. California Corporate License #OD-79693. Axis Insurance Services, LLC is not affiliated with Axis Insurance Company, Axis Capital, its subsidiaries, or affiliates in any way.