Catching a Deal Leak Before It Cost the Deal in Waterloo

The situation

Kwame was the IT support lead at the buyer, a private equity-backed operating company built through a series of acquisitions across Southwestern Ontario. He was not a lawyer or a dealmaker by training, but he understood systems better than anyone else on the team, and that made him useful during due diligence: he was the one who could tell, quickly, whether a target company's software and infrastructure would fold cleanly into the buyer's operations. Parisa, a former court clerk who now managed contracts and compliance for the buyer, ran the paperwork side. Together they formed most of the day-to-day deal team.

The target was a business services company owned by Reza, run out of Waterloo for close to fifteen years. The buyer had signed a letter of intent, a non-binding document that sets out the proposed price and structure while the parties investigate the business more closely, to acquire the company for roughly $22 million. Due diligence, the formal review of the target's finances, contracts, and operations before a deal closes, was underway. Everyone involved had signed a confidentiality agreement, sometimes called a non-disclosure agreement, obligating them not to share information about the proposed sale outside a defined circle of people.

The plan was to keep the sale confidential from Reza's staff until three days before closing. Early disclosure risks losing key employees who start job-hunting the moment they hear a sale is coming, and it risks losing customers who worry a new owner will change pricing or service. Reza had roughly forty employees who knew nothing, and the deal was structured to keep it that way until the last responsible moment.

What the leak revealed

About three weeks before the planned closing date, Parisa got a call from a friend who worked at a different company in Waterloo. The friend mentioned, in passing, that she had heard Reza's company was being sold. She had heard it from her partner, who knew someone on Reza's operations staff. It was second-hand, vague, and not something the friend thought was sensitive, but it meant word had already travelled outside the small group who were supposed to know.

Parisa flagged it to Kwame immediately, and Kwame did what he does well: he checked the data room, the secure online repository where due diligence documents are shared with approved reviewers. Every document in a well-run data room logs who viewed it and when. He found nothing unusual in the access logs themselves, which told the team something important: the leak had not come from anyone with data room access misusing their credentials. It had come from somewhere else, most likely a conversation inside Reza's own company, among people who were never supposed to know the deal existed.

That distinction mattered legally. If a person bound by the confidentiality agreement had leaked, that would be a breach of contract with a defined remedy against a defined party. If the leak had come from an employee of the target who was never a party to that agreement, there was no contract to enforce against them at all. Treadstone's team, acting for the buyer, needed to establish which situation this was before deciding what to do next, and needed to do it without making the problem worse by asking obvious questions that would confirm the rumour to more people.

What we did

1. Traced the likely source without widening the circle. Rather than raising the leak with Reza's staff directly, which would have confirmed the rumour to anyone who had not already heard it, we worked with Reza and his own advisors to identify who inside the company had legitimate reasons to suspect a sale was possible, such as anyone who had noticed unusual activity, visiting outsiders, or a recent slowdown in Reza's normal decision-making. That narrowed the likely source to a small handful of people close to Reza rather than the workforce broadly.
2. Reviewed the confidentiality agreement's actual coverage. The agreement bound Reza, his direct advisors, and anyone he had formally looped in. It did not, and could not, bind employees who had never seen the document. We confirmed with Reza that only two of his senior staff had been told anything in advance, and reminded him in writing of his own obligations to keep that circle from growing further before closing.
3. Tightened data room and communication controls immediately. We reduced the list of people with data room access to only those who still needed it, added a rule that no new documents referencing deal terms could be created outside the room, and moved the remaining diligence calls to a smaller set of named participants. This did not fix the leak that had already happened, but it stopped the pool of people who could cause a second one from growing.
4. Built a specific, earlier communication plan instead of leaving a vacuum. A rumour without an official explanation tends to get worse, not better, the longer it sits. Rather than waiting the full three weeks, we worked with the buyer and Reza to prepare a short, accurate internal message that could go out to Reza's senior staff on short notice if the rumour spread further, explaining the transaction in plain terms and addressing job security directly, so that if containment failed, the company would not be reacting from a standing start.
5. Added protective terms to the purchase agreement before it was too late to negotiate them. Because the leak surfaced while the definitive agreement, the binding contract that finalizes the deal terms, was still being drafted, we were able to add specific representations from Reza confirming who had been told about the sale, along with a non-solicitation covenant preventing Reza from recruiting the target's own staff away after closing if any left prematurely, and a warranty that no material customer contracts were known to be at risk.
6. Monitored for downstream effects through to closing. For the remaining three weeks, we checked in with the buyer regularly on whether any customers or competitors had raised questions, whether any of Reza's staff had resigned, and whether the data room access list needed further trimming. None of those triggers occurred.

The outcome

The rumour that reached Parisa's friend never spread further in any way the buyer or Reza could detect. No employee resigned in the weeks before closing, no customer raised concerns, and no competitor approached the target's staff or clients. The deal closed on schedule at roughly $22 million, and the planned three-day advance notice to staff went ahead as originally intended, delivered by Reza himself with the prepared messaging in hand rather than as a scramble.

This is what a prevented problem looks like from the outside: uneventful. Nothing dramatic happened, no employees were poached, no price was renegotiated because of leaked information, and no litigation followed. That outcome was not luck. It came from treating a vague, second-hand rumour as a real signal worth investigating within a day of hearing it, rather than dismissing it as gossip or waiting to see if it recurred. By the time the confidentiality agreement's protections were tested against a genuine breach, they did not need to be, because the exposure had already been narrowed to a small, known group and the contract terms had been tightened to cover the gap that group represented.

The buyer's post-closing review estimated that a serious leak reaching customers before closing could have cost several hundred thousand dollars in lost contracts and required deal-price adjustments, on top of recruitment costs to replace departed staff. None of that materialized, so no cost was ever booked against it. That is often the hardest kind of legal outcome to demonstrate value from: the client cannot point to a number that was saved because the loss never happened, only to the absence of a crisis that easily could have occurred.

What you can learn from this