Law Firm’s Secure Portal Learns About Merger from the Press

CASE STUDY | Cybersecurity success during a live transaction

Hargreaves Crake has reported a flawless security result after completing a significant merger without a single unauthorised login to its deal portal.

The portal also prevented all but one of the authorised participants from logging in. That participant could view the welcome screen but lacked permission to upload anything.

The system required document owners to authenticate through an approved device, enter a single-use code, confirm their business relationship and complete a verification call. Every stage worked as configured. Several users failed the business-relationship check because the automated system had not been informed that the merger negotiations were taking place.

Unable to exchange drafts, the parties created a WhatsApp group originally intended to organise the signing dinner. Within hours it contained the due diligence index, negotiation points, sixteen versions of the disclosure letter and a photo of the restaurant menu.

Extracts from the group chat

14:04 — Buyer counsel: Can anyone access the data room?

14:07 — Seller counsel: It says I am not an approved member of this transaction.

14:08 — Client CEO: Should I send the schedules here?

14:09 — Information security: Please do not share transaction documents on WhatsApp.

14:10 — Client CEO: How do I upload them instead?

15:21 — Information security: We have escalated this as a priority.

21:46 — Client CEO: Signed. Champagne at 8.

The portal generated an alert when the deal completed because the press release referred to a merger the workspace still classified as preliminary discussion. An administrator updated the status two days later.

The information-security team says the result demonstrates the effectiveness of its controls: no unauthorised person entered the platform. The legal team says no useful work entered the platform either. Both are correct.

A post-matter review recommends risk-based access, transaction-ready contingency procedures and a way to distinguish sensitive data protection from the elimination of all data movement.

Management has thanked the platform team for protecting the documents and is considering an award for exemplary security discipline.

The transaction group has been asked to delete WhatsApp. Several partners have requested a PDF export first, because it is the only complete record of the deal.