DealLawyers.com Blog

Here’s a situation that has to be on the short list of any M&A lawyer’s worst nightmares – a hacker apparently managed to change the payment instructions that a target shareholder provided to a paying agent in connection with a merger, and successfully diverted the shareholder’s consideration to the hacker’s account.  Now, the mess that hacker created has landed in the Chancery Court’s lap. This excerpt from a Law360 story about Vice Chancellor Glasscock’s hearing on motions to dismiss the lawsuit indicates that the paying agent is in the cross-hairs:

Sorenson Impact Foundation and the James Lee Sorenson Family Foundation, expected to be paid for their 4.95 million preferred shares and one convertible note of Graduation Alliance. The complaint redacts the amount that shareholders were entitled to receive. The foundations surrendered their stock certificates according to the merger agreement and followed instructions in a letter of transmittal that was sent to stockholders, they said. But before the money could be wired to their Utah bank account, a malicious third party broke into their email and instructed the law firm overseeing the transaction to wire the money to a bank in Hong Kong instead.

Continental Stock Transfer & Trust Co., the New York-based payment agent in charge of transferring the funds and stock certificates, should have known the request could be fraudulent, the plaintiffs argued.

“Continental was supposed to verify” the information, the shareholders’ attorney, Eric D. Selden of Ross Aronstam & Moritz LLP, said at the hearing. “It’s spelled out in the letter of transmittal, which is part of the merger agreement.” Continental argued that it was simply acting as a transfer agent and was not liable for the loss because it was not a party to the merger agreement itself. Its duties were spelled out in a separate payment agreement, it said.

Although the terms of letters of transmittal have been the subject of some notable litigation, I’m not aware of case law delving into who bears responsibility when the payment of merger consideration is misdirected. That makes this case worth watching. For what it’s worth, it looks like the amount involved is a little more than $3 million. I haven’t found a free copy of the Delaware complaint in this case, but it looks like the plaintiffs’ initially filed one in Utah last summer. The dollar amount of the plaintiff’s loss is noted in that filing, which is available online.  (Hat tip to Brian Quinn for this one!)

– John Jenkins