08:12 — the invitation
An assistant created a video call for a principal, outside counsel, an investment banker and two executives from a target company. The title used the project codename. The body included the target’s registered name, a draft closing date and a link to the diligence workspace.
The invitation was sent from the principal’s general office calendar because that calendar had the best availability data.
08:19 — the first replica
The principal’s calendar synchronised to a household tablet used for schedules and transport. A transport coordinator could see event titles and attendees. The coordinator did nothing wrong. The system had never distinguished logistics from transaction context.
09:03 — the exception
One target executive forwarded the invitation to a personal account to join from a phone. The personal calendar generated a travel-time notification. A consumer service now held the event title, attendees, location assumptions and timing.
Two days later — the approach
A supplier received a convincing message referring to the codename and asking whether a new owner would review contracts after the stated closing window. The sender did not possess the data room. The invitation had provided enough truth to create pressure.
What actually failed
The calendar was treated as an administrative tool, not a disclosure system. The meeting title carried deal identity. The attendee list exposed the adviser graph. The body combined context, timing and access. Broad calendar delegation multiplied the audience. Personal forwarding created an uncontrolled copy.
None of these actions looked like a breach. That is why the exposure survived.
The control that would have interrupted it
- Use neutral event titles that reveal the minimum required to attend.
- Keep access links out of calendar descriptions when a separate authenticated channel exists.
- Separate logistics visibility from meeting-detail visibility.
- Prohibit forwarding transaction invitations to personal accounts.
- Review delegated calendar access before sensitive projects begin.
The invitation test
Before sending a sensitive invitation, imagine its title, attendees and first three lines printed on a hotel lobby screen. If the combination reveals the event, relationship or timing, the invitation is carrying more authority than it needs.