Russia-linked firm defies deal with U.S. national security panel
Cfius threatens to fine Pamplona for breach of agreement to sell out of Cofense
A battle is brewing between a U.S. national-security panel and a Russian-oligarch-backed private-equity firm that failed to meet their agreement.
The U.S. government told private-equity firm Pamplona Capital Management last year to sell out of Leesburg, Va., cybersecurity firm Cofense Inc. U.S. officials raised national-security concerns about the level of foreign money behind Pamplona and the nature of Cofense’s business.
Pamplona committed to finding a buyer to take over its minority investment by July 19, but it failed to do so. Now both the firm and Cofense are in “material breach” of that agreement, according to an email that the Committee on Foreign Investment in the U.S. sent to Pamplona and Cofense last week. The panel, known as Cfius, told Pamplona and Cofense they could face fines each day that they fail to find a buyer for the stake, among other potential penalties, according to the email, which was read to The Wall Street Journal.
People familiar with the matter say Pamplona has dragged out parts of the deal process.
It is a rare snub to the Treasury Department-led interagency panel that vets foreign investment in U.S. businesses for national-security concerns, lawyers and investors say. Few challenge the panel, which can seek a presidential order to enforce its decisions. A Treasury Department spokesman declined to comment.
Cofense simulates and detects attacks transmitted via email to help companies deal with security threats. It counts major U.S. corporations among its customers. A Pamplona spokesman said that dealing with the investment has been “a multiparty process.” “We have worked expeditiously with all parties including Cfius and the company,” he said. “This process remains ongoing and we are working diligently towards a solution.”
Pacific Investment Management Co. explored buying Pamplona’s stake, but weeks before the deadline decided not to proceed with deal talks, according to people familiar with the matter. An initial bid for the Pamplona stake by BlackRock Inc., already a minority stakeholder in Cofense, was rejected as too low, other people said.
Another possible buyer group expressed interest in July, said other people familiar with the matter. An initial deal document included a clause preventing all parties from suing one another. But when Pamplona pulled the clause, the buyer walked from that deal, the people said. Pamplona reached out to BlackRock to restart talks in recent days, one of the people said. One Pamplona executive has expressed resentment over the regulatory scrutiny to people involved in the process. Pamplona executive John Halsted over the past18 months has said: “we are going to f-ing war with Cfius,” according to people familiar with the matter.
Mr. Halsted denies saying this. “For the avoidance of doubt I have never threatened to antagonize, disrupt or ‘go to war’ with any counterparty in this process,” he said.
U.S. intelligence officials have grown increasingly concerned about connections cybersecurity companies have to Russian entities since they began probing Russian interference in the 2016 presidential election.
Several fund investors in Pamplona have been wealthy Russians. One whom Cfius has had concerns with is Mikhail Fridman, according to people familiar with the matter. Allegations that he is part of Russian President Vladimir Putin’s inner circle were a concern for Cfius, one of the people said. Mr. Fridman, a founder of Russian conglomerate Alfa Group, has made his fortune in Russia’s retail, energy and telecommunications sectors.
Mr. Fridman was included on a January 2018 “oligarch watchlist” created by the Treasury Department. A 35-page dossier compiled by Christopher Steele, a former British intelligence official, alleged that Mr. Fridman was among a group of powerful individuals who had a corrupt relationship with Mr. Putin. Mr. Fridman’s lawyer said the allegation in the dossier was untrue and that his client hasn’t been threatened with any Treasury sanctions.
Through a spokesman, Mr. Fridman said that his understanding was that Cfius was concerned about the general level of foreign ownership in Pamplona, and not specifically with him.
Cfius hadn’t issued a final decision by the end of last week on who would pay the potential penalties for violating the agreement it had with Pamplona and Cofense. Cfius has indicated it would want Pamplona to shoulder a substantial share, said a person familiar with the matter. The July 25 email indicated a potential fine of $10,000 a day among other penalties for parties in breach of the deal.
The panel is also considering taking a closer look at other investments Pamplona has made, said other people familiar with the matter. Cfius found at least two additional noteworthy investments Pamplona completed without seeking the committee’s approval, some of the people said. The Pamplona spokesman said the firm hasn’t received inquiries from Cfius about other deals.
Pamplona was part of a group of investors alongside BlackRock that acquired Cofense, formerly known as PhishMe, in a deal announced in February 2018 that valued Cofense at around $400 million. The deal makers didn’t seek Cfius’s approval of the deal in advance, but the panel began making inquiries the following month, Cofense said in April.
In August 2018, following conversations with Cfius, Pamplona resigned its seat on Cofense’s board and by October executed a voluntary agreement with the panel to sell its stake, which was transferred to a trustee, Cofense said at the time.
Cofense is powerless to push a deal without the cooperation of Pamplona and the trustee. “Cofense continues to cooperate with Cfius and to comply with all prescribed actions as a result of this investigation,” according to a company statement in April.
Cofense’s valuation has deteriorated during the troubled sales process, according to people familiar with the matter.