Why Pay Attention to Cybersecurity in Franchise M&A Deals

Cybersecurity considerations often take a back seat to other concerns in merger and acquisition (M&A) proceedings, but that approach can cause problems down the road. In this blog post, we’ll provide an overview of cybersecurity in the franchise world today. Then we’ll share three reasons why cybersecurity should play a bigger role in franchise M&A deals. Finally, we’ll discuss how a trusted lender like First Franchise Capital can help buyers see the big picture and make good decisions when considering a franchise acquisition.

Cyberthreats in the franchise restaurant space

Modern franchise restaurants provide many potential gateways for cybercriminals to access their systems. Point-of-sale (POS) systems are a valuable target because they handle customer credit card data. Robotic fryers and burger flippers can be compromised, causing downtime and lost sales. Third-party delivery services can be hacked, potentially opening a restaurant’s systems to attack through their vulnerability.

The most prevalent form of cyberattack currently comes via ransomware. Bad actors may access a restaurant’s system via third-party vendors, compromised passwords, scheduling software, and even the public WiFi many restaurants offer. Once in, these cybercriminals hold the restaurant’s data and operations hostage, demanding a monetary ransom in exchange for a (promised) return to normal operations. They may also take customer data – sometimes including credit card information – and sell it on the dark web.

Three reasons to take cybersecurity seriously in M&A

Reason 1: Any problems with the target will become problems for the buyer

Whenever one company takes over another, they assume both the good and the bad aspects of the target company. With cybersecurity, that can mean taking on the liability for a past data breach or one that occurs during the transition period.

It also means that any weaknesses in the target’s cybersecurity can now compromise the security of the other companies in the buyer’s portfolio.

Reason 2: The target’s third-party arrangements can lead to risks for the buyer

If the target has not thoroughly vetted their third-party vendors (software providers, suppliers, delivery services, hardware providers, etc.) they can be at risk for security failures those companies experience. After the sale, those risks become the buyer’s.

In the M&A process, acquirors should determine if they will maintain the target’s service partnerships or convert them to those of the buyer.

Reason 3: The buyer’s cybersecurity may not be faultless

It isn’t just the target’s cybersecurity that should be evaluated during M&A. This is also a prime time for the buyer to evaluate their own security and address any vulnerabilities.

Buyers can use asset discovery tools to identify all forms of information technology they and the target operate, then assess them for potential problems. Additionally, they can use data breach discovery tools to look for past breaches that may have happened without management’s knowledge.

How can a lender help?

When considering a franchise acquisition loan, it’s important to realize that not all lenders are alike. Some, like First Franchise Capital, specialize in lending to the franchise industry and understand how operations in a franchise restaurant work.

A trusted lending partner will perform extensive due diligence to make sure the cash flow from the joined companies will be sufficient to repay the loan. This process benefits both the lender and the borrower because it can identify potential problems before the buyer is committed to the purchase, and it lessens the chance of default on the loan. As part of this process, the lender will expect to see financial statements and tax returns going back three years, franchisee agreements, and any relevant contracts.

Moving forward

 It’s never too early to start talking with a lender about potential franchise acquisition plans. Get to know them and find out if they’re a good fit. Look for lenders who want to have a long-term relationship and who will go the extra mile to see that their clients have all the resources they need.