A detailed security audit of their systems should have uncovered areas where their security was lacking and they should have undertaken steps to remedy the defe

A detailed security audit of their systems should have uncovered areas where their security was lacking and they should have undertaken steps to remedy the defects. It’s something you should do during an acquisition anyways. If their software is crap, the price of acquisition should decrease by some amount in anticipation of the work required to meet data protection laws. Not performing the audit means not only are you likely to pay too much for the acquired company, but it also opens you up to liability as was the case here.