During the flurry of documents, deadlines and meetings needed to close a merger or acquisition deal, companies can easily let their guard down. 

And according to cybersecurity provider FireEye's "M-Trends" report, hackers are relying on that loosened vigilance to successfully leverage what FireEye Mandiant CTO Charles Carmakal called "second-round" phishing emails.

Carmakal explained this is when a hacker phishes an organization with an unrelated email domain. Once the hacker has access to the employee's email, the hacker uses the compromised account to email other employees in the organization. 

The report, which was released in March and examined cybersecurity trends through incident response investigations conducted by FireEye's security and breach consulting service, found that second-round phishing is particularly effective during mergers and acquisitions, "since employees expect communication, sometimes unsolicited, between the organizations," 

"Many threat actors are interested in confidential M&A data," Carmakal said in an email. "We have observed threat actors hacking into email accounts to obtain access to confidential M&A information."  

Roland Trope, partner at Trope and Schramm and co-editor of the American Bar Association's "Guide to Cybersecurity Due Diligence in M&A Transactions," noted that techniques to detect phishing emails should be enforced during M&As to prevent successful attacks.

"You can take security precautions so you know when something is from a legitimate source, but what often happens is phishing attacks are from a known party," Trope said. "I think increasingly counsel are going to caution companies, especially after this report, to train their people before a transaction to be extra careful."

For employees that are involved with the day-to-day tasks of managing the acquisition, emails from inside and outside of the organization are expected and should be accepted—after the sender and inquiry's authenticity has been confirmed. 

Joseph Lazzarotti, a Jackson Lewis principal and privacy, data and cybersecurity practice group lead, said that while the organizations aren't fully acquainted, someone could provide a list of contact information of people that should be sending them emails from outside of the organization.

However, Lazzarotti acknowledged the pressures of finishing a deal may outweigh significantly vetting emails that pass an organization's email filters and seem legitimate. "It's not a foolproof solution, but I think certainly there can be communication about the emails they can respond to in carrying out the transaction."

Still, Trope added that if in doubt, it's easy to pick up a phone and directly contact someone. "I think a good precaution for employees, anytime they get something out of the ordinary that they weren't aware, should [be to] contact the party directly and ask, 'Did you send me this?'"

Although Trope and Lazzarotti hadn't specifically heard of second-round attacks being used during M&A deals, they said a company's cybersecurity is a subject that can significantly influence an organization's evaluation during a merger.

Indeed, a Forescout Technologies Co. survey found 93% of IT professionals and business executives said cybersecurity is as an important factor during a M&A deal.

Trope noted, for example, that the Verizon-Yahoo merger resulted in a $350 million price cut because of the search engine giant's massive data breaches.