--- id: CP-364 slug: virtual-data-rooms-deal-confidentiality lang: en title: Virtual data rooms and sensitive deals description: "Acquisition, fundraising, audit: how to spot the fake links, fake transfers and fake contacts that target a data room." canonical_url: https://startbrain.io/cyberpedia/en/articles/virtual-data-rooms-deal-confidentiality/ markdown_url: https://startbrain.io/cyberpedia/en/articles/virtual-data-rooms-deal-confidentiality.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Virtual data rooms and sensitive deals", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/virtual-data-rooms-deal-confidentiality/ (CC BY 4.0) wing: 5 theme: handle_scams reflex: cr-083 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/virtual-data-rooms-deal-confidentiality/ fr: https://startbrain.io/cyberpedia/fr/articles/salles-de-donnees-virtuelles-confidentialite-operations/ de: https://startbrain.io/cyberpedia/de/articles/virtuelle-datenraeume-vertraulichkeit-transaktionen/ es: https://startbrain.io/cyberpedia/es/articles/salas-de-datos-virtuales-confidencialidad-operaciones/ sources: - "n": 1 title: "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/002/ accessed: "2026-11-03" - "n": 2 title: "Phishing for Information: Spearphishing Link, Sub-technique T1598.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/003/ accessed: "2026-11-03" - "n": 3 title: Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1534/ accessed: "2026-11-03" - "n": 4 title: Financial Theft, Technique T1657 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1657/ accessed: "2026-11-03" - "n": 5 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 6 title: Recognize and Report Phishing | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 7 title: Que faire en cas de phishing ou hameçonnage ? - Assistance aux victimes de cybermalveillance publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing published: "2020-01-10" accessed: "2026-11-03" - "n": 8 title: "Phishing scams: how to spot and report them" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" --- # Virtual data rooms and sensitive deals A sensitive deal (an acquisition, a fundraising round, a legal audit) requires sharing confidential documents with people outside the company: a buyer, investors, lawyers, auditors. The documents are often placed in a virtual data room, an online space where each person is invited and where access to each item is set. The sources cited here do not describe data rooms themselves. They describe the phishing, impersonation and transfer-fraud techniques that target any sharing space. This page draws from them what concerns an employee involved in a confidential deal, without claiming anything about how a particular platform works. ## In 30 seconds - Where it happens: in an invitation email, a transfer request or a message from a supposed lawyer or executive, around a deal that is not public. - What the attacker wants: to steal credentials to get into the sharing space, to obtain information or to trigger a transfer. - The reflex: check every unusual invitation or request through a second channel that you choose yourself, without using the contact details given in the message. - If it's already done: warn the people in charge of security right away and change the passwords concerned. ## Straight answers ### Why does a sensitive deal attract scammers? Because it brings together people who do not always know each other, urgent messages and money. MITRE describes spearphishing as a manipulation message sent to a specific individual, company or industry [1]. The attacker can pose as a trusted source [1]. A deal under way provides a ready-made pretext. ### Can an invitation link be fake? Yes. According to MITRE, the fake site can be a clone of a legitimate login portal, or look like it and carry an address that reuses elements of the real one [2]. The message is often accompanied by several seemingly urgent follow-ups [2]. The goal is to collect credentials or other usable information [2]. ### Is a message from a colleague necessarily safe? No. When an internal account is compromised, the attacker uses it to trap other people in the same organization, often by impersonating an identity [3]. MITRE also lists internal messaging tools, such as Microsoft Teams, among the channels used [3]. It notes that this type of attack is hard to prevent with technical controls, since it abuses normal functions [3]. ### Can you be asked for a transfer connected to the deal? Yes. In CEO fraud or business email compromise, the attacker imitates a trusted entity, then the victim sends money to an account the attacker controls [4]. MITRE specifies that these incidents can have several victims: the compromised accounts and the one that loses the money [4]. ## How it works Social engineering, according to CISA, consists of obtaining information about an organization through human contact. The attacker can present as a new employee, a repairperson or a researcher, and even supply false credentials [5]. If the attacker does not get enough from one person, they contact another in the same organization and rely on what the first one said to seem credible [5]. Applied to a confidential deal, this gives two scenarios. In the first, a fake invitation message leads to an imitated login page. The credentials entered are then used to get into the victim's accounts. In the second, the attacker inserts themselves into the exchanges, takes on the identity of a lawyer or an executive and asks for a document, a piece of information or a payment. ## What you do - Check the identity of each new invitee or contact by a means other than the message received. CISA recommends reaching the person another way, for example by calling if you have their number [6]. It also asks that you not use the contact details on a website linked to the request, and instead use those from earlier exchanges [5]. - Do not click the link in a suspicious message. Cybermalveillance.gouv.fr advises hovering over the link without clicking to see the real address, or using a bookmark you created yourself [7]. The address shown in the browser must match the expected site exactly, because a single character can change [7]. - Do not share information about the organization, its structure or its networks until you are certain the person is entitled to receive it [5]. - Do not reply to a message asking for sensitive information by email: CISA advises against giving it through that channel and against following the links received [5]. - Turn on multifactor authentication when it exists: it stops a third party from getting into an account with the password alone [6]. - Report unusual requests. CISA states that the report button is usually near the sender's address [6]. The sources cited here cover neither watermarking, nor per-folder permissions, nor the access log of a data room: the team that administers the platform is the only one able to answer on these points. ## Pitfalls ### Urgency and pressure CISA lists among the common signs urgent or emotional language that announces serious consequences if there is no immediate reply [6]. It also cites requests for personal or financial information and incorrect addresses or links [6]. A signing deadline is not a reason to skip a check. ### Messages without mistakes CISA notes that poor spelling was long a clue, but that some emails now have perfect grammar in the age of artificial intelligence. The other signs must therefore be looked for [6]. ### The almost exact address Attackers use an address close to that of a known company, changing or omitting a few characters [5]. A link whose displayed text does not match the destination on hover may be forged [5]. Shortened addresses hide the real destination [5]. ### The imitated login window MITRE describes a so-called "browser-in-the-browser" attack: a fake pop-up window with an imitated address bar, which displays a legitimate-looking address and bypasses the usual address check [2]. MITRE also describes trapped consent: a malicious OAuth 2.0 authorization request which, once accepted, gives an application rights over the account [1]. A stolen token makes it possible to act on the user's behalf [1]. ### The message to the wrong recipient The sources cited here do not cover wrong-recipient mistakes, which stem from inattention rather than attack. The reflex of rereading the address before sending does not appear in them; this page therefore sticks to what is sourced: check the identity of those to whom you send material. ## If you have already clicked or replied CISA asks that any possible disclosure of sensitive information be reported without delay to the competent people in the organization, including network administrators, so that they can watch for abnormal activity [5]. Revealed passwords must be changed without delay, along with those of other accounts where the same password was used [5]. Cybermalveillance.gouv.fr adds that evidence should be kept, in particular the phishing message received [7]. In the case of a fraudulent debit or payment details that were given out, the same source asks that you contact your bank to block the payment method (stop payment) [7]. It also mentions filing a complaint [7]. On the British side, the NCSC explains that it can investigate scam addresses and websites and have them removed, and that reporting a message is free and takes a minute [8]. ## Sources 1. MITRE ATT&CK, "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing for Information: Spearphishing Link, Sub-technique T1598.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/003/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1534/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Financial Theft, Technique T1657 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1657/ (accessed 3 November 2026) 5. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 6. CISA, "Recognize and Report Phishing | CISA". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 7. Cybermalveillance.gouv.fr, "Que faire en cas de phishing ou hameçonnage ? - Assistance aux victimes de cybermalveillance", 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026) 8. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/virtual-data-rooms-deal-confidentiality/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.