Cybersecurity · Industry brief
Top three stories shaping Cybersecurity today, written for someone who already works in the industry: regulation, M&A, new entrants, notable filings, and any precedent worth pulling. Cite the trade publication (e.g. trade press, government source, court docket) directly so I can follow up.
M&A remedies tighten, NIS 2 accountability spreads, deal abandonment accelerates
1 Min. Lesezeit
US M&A remedies shift
Structural remedies are back in favor at the FTC.
Q2 2026 saw competition authorities embrace divestiture and behavioral conditions as deal approval prerequisites, with the DOJ's ready-mix concrete remedy requiring three-plant divestitures in San Diego County to clear the CalPortland-Vulcan transaction [Quelle: McDermott]. Federal approval no longer guarantees passage—state attorneys general challenged the Nexstar/TEGNA broadcast deal in April despite DOJ clearance, signaling enforcement fragmentation that bidders now must price into deal risk.
Expect remedy negotiations to lengthen closing timelines.
De facto merger theory gains traction
Commercial arrangements now face merger scrutiny.
A federal judge denied Zillow and Redfin's motion to dismiss FTC complaints over their $100 million contractual exit from multifamily rental advertising in May 2026, holding that customer transfers and business-information sharing may trigger merger law even without formal acquisition [Quelle: McDermott]. The ruling broadens enforcement reach beyond traditional asset purchases to behavioral deals. Getty's termination of its Shutterstock merger post-CMA conditional clearance in June reinforces that even approved transactions carry execution risk if remedies prove unworkable.
Transactional counsel should audit commercial partnerships for hidden merger exposure.
NIS 2 accountability spreads to C-suite
European regulators are making board members personally liable for breaches.
Wolf Theiss lawyers documented Bulgaria's expansion of NIS 2 obligations beyond technical compliance into senior management accountability, with enforcement sanctions tied directly to governance failures and incident preparedness [Quelle: Wolf Theiss]. This mirrors precedent established in earlier enforcement waves across financial regulators. Businesses face dual risk: technical penalties for inadequate controls and personal liability for board-level governance lapses. Expect this model to spread across remaining EU member states before year-end.
D&O insurance policies now merit immediate review.
US M&A activity: Remedies return & HSR form reverts2 hours ago ... McDermott lawyers summarize US antitrust M&A activity for Q2 2026, including returning remedies, state resilience, and HSR form changes under Trump 2.0.mcdermottlaw.com

This content does NOT contain news about specific cybersecurity M&A deals, cybersecurity regulatory compliance enforcement, or information security industry mergers and acquisitions. The article is a general antitrust/M&A snapshot covering FTC and DOJ enforcement trends, remedy proposals, and HSR form changes—with examples from retail markets, concrete production, broadcasting, and entertainment sectors. While it discusses M&A enforcement broadly, it contains no cybersecurity-specific deals, regulations, or industry developments. Returning empty string as instructed for non-relevant content.
Global M&A trends: 6 notable Q2 2026 cases | McDermott2 hours ago ... ... deals moving forward. Topics. main / Insights / Topics. Private Capital · Global Privacy & Cybersecurity ... Notices/Imprint · Privacy Policy · Terms of Usemcdermottlaw.com

Global competition authorities remained active in Q2 2026, with enforcement outcomes ranging from unconditional clearances to targeted structural remedies and deal abandonment. The Nexstar/TEGNA transaction received federal DOJ and FCC approval but faced a preliminary injunction from state attorneys general and private plaintiffs challenging the broadcast television station combination under Section 7 of the Clayton Act on April 17, 2026, underscoring that federal clearance does not preclude state or private antitrust enforcement. The DOJ accepted a ready-mix concrete divestiture remedy on May 21, 2026, requiring CalPortland and Vulcan Materials to divest three ready-mix concrete plants in San Diego County to Holliday Rock Co., demonstrating the agency's preference for structural relief to resolve specific competitive concerns while allowing broader transactions to proceed. The European Commission cleared RTL's acquisition of Sky DACH unconditionally on April 22, 2026, finding that global streaming platforms provide sufficient competitive pressure in audiovisual content, wholesale TV channels, and advertising markets. The FTC and state plaintiffs advanced a "de facto merger" theory on May 6, 2026, when a federal judge denied Zillow and Redfin's motion to dismiss complaints over their $100 million contractual arrangement involving exit from multifamily rental advertising, holding that commercial arrangements transferring customers and business information may attract merger scrutiny even without formal acquisition. Getty Images terminated its merger with Shutterstock in June 2026 after the CMA conditionally cleared the deal in May 2026 requiring divestiture of Shutterstock's global editorial business, finding that generative AI addresses stock-content competition but editorial content remained concentrated.
Wolf Theiss insights: navigating NIS 2 obligations and management ...12 hours ago ... Publication Announcements ... nikola.naydenov@wolftheiss.com. V-card. Expertise. Corporate M&A Data & Cybersecurity Regulatory & Administrative Law ...wolftheiss.com

Wolf Theiss lawyers published two articles in Bulgarian trade publications examining NIS 2 regulatory obligations and their impact on businesses in Bulgaria. An Investor.bg article by Anna Rizova and Nikola Naydenov analyzes the directive's scope, governance requirements, and integration of cybersecurity into corporate management. A Banker.bg article by Oleg Temnikov and Nikola Naydenov addresses senior management accountability for cybersecurity, governance obligations, compliance sanctions, and incident preparedness under NIS 2.