In fintech, data breaches spur boom in cybersecurity deals

One of the biggest growth areas in fintech right now is cybersecurity, the old-school sector that refers to companies that help secure payments, fight fraud or manage compliance requirements.

Private equity has been investing in cybersecurity for more than a decade. Recent big-name hacks have given a fresh boost to the sector. Nearly every other day, companies are reporting that hackers have breached their systems, exposing the personal information of customers.

One of the biggest breaches came from Equifax, which in 2017 revealed that hackers accessed the personal data of 143 million customers. Verizon, which acquired Yahoo in June 2017, said last year that a 2013 data breach at Yahoo actually affected every one of that company’s customer accounts, or three billion in all.

This year’s big data breach involved Facebook. Cambridge Analytica had accessed the personal data of 87 million people on the social network. Facebook CEO Mark Zuckerberg in April had to defend his company’s handling of data before Congress.

Hacks are the new normal. “Folks expect to get breached,” said Collin Roche, a GTCR managing director. “It’s just a question of how big, how bad, how often. It’s a continuous battle to adopt the right services and products to manage data integrity.”

Companies once were able to “insulate the perimeter” but personal data is everywhere, Roche said. Hackers are more sophisticated, and are motivated by economic or other interests to get the data. “It’s just an arms race,” he said.

Cyberfirms are commanding high valuations. For example, Vista Equity Partners acquired Paymetric, which provides payments acceptance and data security, for about $525 million last year. Francisco Partners scored a more than 6x return on the sale, Buyouts has reported.

“There is absolutely lots of investment in this sector,” added Ken Schiciano, co-head of the North American technology group at TA Associates.

Last year, global fintech investments hit a high-water mark, with $16.6 billion invested in 1,128 deals, up 20 percent in investment value and 10 percent in deal volume, CB Insights reports.

This year, the fintech sector has seen nearly 25 deals from PE investors, CB Insights said. This includes GI Partners’ buy of Doxim and TA’s buy of Confluence.

Cyber, or digital-security software and services, continued to receive much PE interest in Q1. More than $2.4 billion was invested in 10 companies in Q1, down from roughly $2.9 billion in 11 companies in Q1 2017, PitchBook said.

First-quarter deals included Thoma Bravo’s $1.6 billion buy of Barracuda Networks (announced in November), Pamplona Capital/BlackRock’s $400 million acquisition of Cofense and LLR Partners’ $30 million investment in Midigator, CB Insights said.

Blockchain appeal

Any conversation about fintech investing must include blockchain and cryptocurrencies. Blockchain is technology that supports bitcoin and other cryptocurrencies. It is an enabling infrastructure technology that can be used to manage ledgers or databases, executives said. “The blockchain at scale must be proven before any crypto currency becomes viable,” said Chris Winship, a partner at FTV Capital.

Blockchain has been heralded as the great savior that’s expected to improve everything from the internet-of-things to banks.

The practical applications of blockchain are still unclear, several PE executives said. Companies are trying to figure out how to harness the technology, they said. “It’s a solution looking for a problem,” quipped GTCR’s Roche.

Some predict blockchain will transform payments, which continues to be a hot sector of investment for PE. Others don’t agree. “It will take a long time before blockchain has any material impact on payments. However, the prominent payments brands are certainly investing time and money evaluating how blockchain might play a role in the payments ecosystem,” FTV’s Winship said.

American Express and Banco Santander last year announced a partnership to launch cross-border payments using Ripple technology. In April, Santander unveiled its app, Santander One Pay FX, which enables consumers in Spain, U.K. and Brazil to complete international transfers on the same day. It’s unclear if American Express is launching something similar.

“The proof of concept is in process now, but I’m hard-pressed to name anything in the production environment for blockchain other than bitcoin,” TA’s Schiciano said.

No one would argue that ACH, the electronic-funds-transfer network used in the U.S., or SWIFT in Europe, is horribly inefficient as a means to transmit funds, Spectrum Equity Managing Director Adam Margolin said. “It’s just too early to know if a blockchain-based approach will emerge as the primary replacement,” he said.

Also too early

Cryptoexchanges, like Coinbase, have also generated much buzz. Coinbase in August raised a $100 million D round led by IVP. The exchange made its first real deal in April when it acquired for $100 million.

PE firms have been major investors in exchanges but have yet to do anything with cryptoexchanges. TA Associates, whose deals include Island ECN, ICE and Bats Global Markets, has backed off from cryptoexchanges until regulatory issues are worked out, Schiciano said. “It’s still too early for TA to invest,” he said.

Last month, the SEC warned investors to be careful because many cryptoexchanges were unregulated. The regulator also reminded exchanges that they need to register with the SEC.

New York Attorney General Eric Schneiderman this month also launched an investigation into bitcoin exchanges, including Coinbase, Gemini Trust and Bitfinex, press reports said. The New York AG wants transparency, including information on the exchanges’ operations and how they are protecting consumers.


Private equity has long been an investor in insurers. The sector has also produced some very established insuretech companies, like Guidewire, Solera (Vista), and Vertaforte (Bain, Vista), that have been or are backed by PE.

Companies looking to disrupt the traditional insurance carrier/agent market are getting much attention from PE. Many of these insuretechs are just not big enough for PE to invest in, executives said.

Consider Lemonade, whose slogan is “Forget Everything You Know About Insurance.” The company uses AI and bots to speed up claims and cut paperwork for renters and homeowners. Lemonade raised a $120 million Series C round in December led by SoftBank. Other investors include VCs firms like General Catalyst, Alphabet Inc’s GV and Sequoia Capital.

“Direct-to-consumer insuretech business models [like Lemonade] trying to disrupt traditional agent distribution usually require significant amounts of capital to build a consumer brand,” Margolin of Spectrum Equity said.

“Given the cash burn, they are generally too early-stage for growth equity and growth buyout firms focused on capital-efficient businesses.”

TA’s Schiciano agrees that some insuretechs may be too soon for private equity. PE may participate in the sector by acquiring early-stage companies as add-ons through larger portfolio companies, Schiciano said.

Not so hot

One area that has cooled off this year is online lending. Silver Lake led a $500 million round for Social Finance in February 2017, which later that year filed for a bank charter (and then pulled that charter application). Warburg Pincus and TPG’s Rise Fund in January led a $45 million round for Varo Money, which has filed for a bank charter.

GTCR’s Roche says the online-lending strategy, which includes reducing costs for loan borrowers and providing a better product for consumers, “makes tons of sense.” The category, however, got overblown; a pullback is healthy and will “force people to think about the online business model,” Roche said.

American Express could not be reached for comment.

Action Item: Contact GTCR’s Collin Roche at +1 312-382-2214

Facebook CEO Mark Zuckerberg testifies before a House Energy and Commerce Committee hearing regarding the company’s use and protection of user data on Capitol Hill in Washington on April 11, 2018. Courtesy of REUTERS/Leah Millis