Why does M&A increase the risk of source code and R&D data theft?

The deal creates uncertainty, and uncertainty changes behaviour while access often remains unchanged. Employees who fear role loss, plan to leave, or disagree with the new direction may use their existing access to move valuable material through permitted channels, which is why the risk rises before close rather than after it.

Why M&A Changes the Theft Window for Source Code and R&D Data

M&A raises theft risk because it changes incentives faster than it changes access. People who feel uncertain about their future, or who think valuable work may be moved, cut, or re-owned, often already have legitimate access to repositories, design documents, and research systems. That combination makes pre-close exfiltration a practical insider-risk problem, not just a post-close integration issue.

The important shift is behavioural. M&A can trigger resignation thinking, retaliation, opportunism, or simple self-protection, and those motives matter most when the person can still use normal business channels. A developer, researcher, architect, or contractor does not need to break in if they can copy code, export documents, or sync data while their privileges still look routine.

This is why source code and R&D data are especially exposed. They are high-value, easy to duplicate, and often distributed across Git platforms, file shares, collaboration tools, and personal workstations. Once a person decides to leave or resist the transition, the act of moving material can look operationally normal unless the organisation has strong monitoring, restrictive egress controls, and clear ownership of sensitive repositories.

How Legitimate Access Becomes the Attack Path

The core failure mode is not that M&A creates new access, but that it preserves existing access during a period of weakened loyalty and heightened ambiguity. In that window, exfiltration can happen through approved tools, sanctioned sync clients, private messaging, removable media, or cloud collaboration spaces, which makes detection harder than a classic perimeter breach.

That dynamic is why the Twitter source code leak 2023 is a useful cautionary example of how departing personnel and retained access can turn normal repository access into data loss. It is also why Slack GitHub breach 2022 and Internet Archive breach 2024 matter here, because they show how repository access and tokens can expose both source code and adjacent sensitive data when control over who can still reach what is weak.

For M&A, the key point is that the attacker may already be inside the trust boundary. The practical question is not only whether someone can authenticate, but whether they can still move large amounts of valuable intellectual property without triggering review, blocks, or behavioural anomalies.

Which Controls Reduce the Pre-Close Exfiltration Window

Effective defence starts with classifying the highest-value codebases and research stores before the transaction closes, then narrowing who can read, clone, export, or share them. Strong controls include access recertification, temporary privilege reduction, tighter repository permissions, DLP coverage for code and document stores, and rapid review of offboarding or transition lists where deal uncertainty is highest.

Credential and token hygiene is equally important because M&A often leaves old access paths alive longer than intended. If collaboration platforms, Git hosting, cloud consoles, or research portals are reachable through long-lived tokens or unmanaged accounts, the organisation is depending on trust and memory at the exact moment those assumptions are least reliable.

Those mechanics are well illustrated by EmeraldWhale Git config credential theft and Mercedes-Benz GitHub token exposure 2024, where exposed access material turned repository access into broader compromise. For a deal context, the lesson is simple: if a person or token can still reach the asset, assume copy risk unless the control model says otherwise.

Good M&A security also separates business continuity from data continuity. Teams sometimes preserve access so work can keep moving, but that choice should be deliberate, time-bound, and reviewed against the actual value of what is reachable. Otherwise the organisation protects the transaction and loses the intellectual property.

Risk and Threat Considerations

M&A creates a short period where motivation changes faster than governance. That is the danger: employees or contractors with already-authorised access may decide to preserve leverage, prepare for departure, or move material before controls are tightened, and source code plus R&D data are exactly the kinds of assets that can be copied quietly.

Failure mechanism: Retained access, weak monitoring, and permissive collaboration channels let a disgruntled or uncertain insider move valuable material through normal workflows before offboarding or integration controls catch up.

Impact: The result can be source code loss, R&D leakage, competitive harm, legal exposure, and a harder attribution problem because the activity may look like routine work rather than overt compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	M&A exfiltration risk depends on knowing who still has access to sensitive code and R&D assets.
Recommendation — Review and remove unnecessary accounts and access paths before the transaction closes.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Reduce the amount of source code and R&D data any one user can still reach during deal uncertainty.
	AU-6 — Audit Review, Analysis, and Reporting	Bulk copying and unusual repository access need review during the heightened M&A risk window.
Recommendation — Restrict access to the minimum required for active business continuity. Monitor and review access logs for anomalous downloads and exports.
ISO/IEC 27001:2022	A.5.18 — Access rights	Access rights must be revalidated when ownership and incentives change during M&A.
Recommendation — Reassess and adjust access rights for sensitive repositories and research stores.
OWASP Non-Human Identity Top 10	NHI-01 — Improper Offboarding	M&A frequently creates delayed or incomplete access removal for people and systems that can still reach sensitive assets.
	NHI-05 — Overprivileged NHI	Repository and collaboration access paths become more dangerous when privileges exceed what the deal period requires.
Recommendation — Revoke access promptly when roles change or departure becomes likely. Trim privileged access paths that are unnecessary during the transaction window.

Practitioner Guidance

What to prioritise: Treat the highest-value repositories, design stores, and research shares as transaction-critical assets, not ordinary endpoints. The first question is whether current access still matches the business need during the deal window, not whether the user is still technically employed.

Decision rule: If a person can still read, clone, export, or sync crown-jewel material, reduce that access before you rely on behavioural monitoring alone. If the role truly requires ongoing access, make it time-bounded, reviewed, and traceable.

What to verify: Confirm who has active access to source code, R&D folders, code-hosting tokens, and collaboration systems, and check whether departure risk, role uncertainty, or deal involvement is changing behaviour. Also verify that logging and alerting can distinguish normal engineering activity from bulk export or unusual download patterns.

Practitioner takeaway: In M&A, the risk is rarely a lack of authentication, it is the mismatch between unchanged access and changed intent, which means pre-close containment matters more than post-close investigation.