The 2019 buyout of NSO by its founders and Novalpina Capital

analysisOn 14 February 2019 Novalpina Capital published a press release announcing that NSO Group's management team and founders were acquiring the company from the private equity firm Francisco Partners. The buyers' announcement said the acquisition was led by the co-founders Shalev Hulio and Omri Lavie with members of the senior executive team and many employees, supported by Novalpina Capital as equity partner, with Jefferies Group LLC advising and leading the financing, and that NSO had finished 2018 with revenues of $250 million and dozens of licensed customers, a figure that is the company's own. WhatsApp's complaint of October 2019 alleged the same sequence: financing from 2014 by a San Francisco-based private equity firm that ultimately bought a controlling stake, and reacquisition by the founders in and around February 2019. ^{1 2}

analysisFrancisco Partners told the authors of the 2021 NGO report that on 18 March 2019 OSY Holdings disposed of its entire interest in Triangle Holdings and Eran Gorev sold his whole interest too; after that, it said, neither it, its fund, OSY Holdings nor any associated person, Gorev included, kept any ownership or economic interest in NSO Group, and Gorev, Matt Spetzler and Andrew Kowal resigned as directors. A 2023 European Parliament report dates Francisco Partners' sale of its entire interest to Novalpina to 14 February 2019, the day the deal was announced. ^{3 4}

analysisAccounts of the terms differ in what they measure. Israeli business reporting in 2022, based on Tel Aviv court documents, said the deal valued NSO at over $1 billion: Hulio and NSO's management held 30% and Novalpina acquired 70% through a direct investment of $290 million, $100 million in shares from Hulio and his associates and $400 million of bank loans placed in the holding company controlling NSO. A 2022 news agency report said Novalpina borrowed $500 million and placed the debt in the holding company above NSO, and the fund's general partner told a New York court in 2025 that the fund acquired the NSO Group for €218.5 million. These press accounts and the party's filing describe different components, such as enterprise value, equity cheque and borrowing, and are not reconciled in the retained records. ^{5 6 7}

analysisAccording to the 2021 NGO report, the Luxembourg fund Novalpina Capital Partners I SCSp, registered on 23 August 2017, had commitments above its €1 billion target. Its limited partners included the Oregon Public Employees Retirement System (18%), the Alaska Permanent Fund Corp. (5.1%), South Yorkshire Pensions Authority (2.7%) and East Riding Pension Fund (1.4%); these are shares of commitments to the fund, not stakes in NSO. The fund invested through Novalpina Capital Partners I LuxCo S.à r.l. (incorporated 13 November 2017) and, for NSO, through NorthPole Holdco S.à r.l., wholly owned by LuxCo. Its general partner, Novalpina Capital Partners I GP S.à r.l. (incorporated 18 August 2017), was ultimately owned by Novalpina Capital Group S.à r.l. of Stephen Peel, Stefan Kowski and Bastian Lueken; an English High Court judgment of 2025 likewise says the fund, now NOAL SCSp, was set up in 2017 by Kowski, Lueken and Peel. ^{1 2 3}

analysisRegister minutes summarised in the report record that on 19 March 2019 LuxCo's shareholders resolved that 893,750 class 2 tracking shares would track the investment in NorthPole Holdco, and on 8 May 2019 the fund contributed those shares (valued at EUR 32,564,682) and a receivable of EUR 184,465,145, together EUR 217,029,827, to a new company, Novalpina Capital Partners I LuxCo North S.à r.l. ¹

analysisLuxembourg register publications summarised by a company-data aggregator record NorthPole Holdco S.à r.l. (B226434), originally Eighteen Scabiosa S.à r.l., with LuxCo as shareholder and Gaëtan Dumont, Allen Foley and Philip Zarb Mizzi as managers from 30 November 2018. Stefano Pileri and Michael Elie Zini became managers in July 2021 and were replaced by Dumont and Foley in August 2021; Tamara Makarenko became a manager on 24 February 2022, Dumont and Foley left on 1 March 2022, and James Ward became a manager on 20 October 2022. ³

analysisAccording to the 2021 NGO report, after transactions in April 2019 Triangle Holdings owned 31.4% of Square 2 ($22 million of $70 million) and NorthPole Holdco owned 68.6% ($48 million); Square 2 owned NorthPole Bidco, which owned NorthPole Newco, which owned OSY Technologies, and OSY continued to own IOTA Holdings, Q Cyber Technologies S.à r.l., Q Cyber Technologies Ltd and Westbridge Technologies Inc. Aggregator summaries of the register date the steps: NorthPole Holdco became a Square 2 shareholder on 11 April 2019 (capital $70.8 million); NorthPole Newco, registered on 5 December 2018 as Eighteen Jasmine S.à r.l. and renamed on 31 January 2019, had NorthPole Bidco as shareholder from 15 April 2019; and NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019. The underlying publications were not retained. ^{1 2 3 4}

analysisBoards were rebuilt in the same weeks, according to register minutes summarised in the NGO report and an aggregator summary of the register. At Square 2's meeting on 1 April 2019 Triangle resigned as sole manager; Stefan Kowski, Stephen Peel, Mickaël Betito, Gerhard Schmidt, Zamir Dahbash and Günter Maximilian Schmid (recorded in Triangle's December 2019 minutes as Maximilian Schmid Günter) became class A managers and Omri Lavie, Shalev Hulio and Yuval Somekh class B managers. At OSY, OSY Holdings Ltd., Eran Gorev and Kevin Wilson were removed and the same class A managers, with Lavie and Hulio as class B managers, appointed; the aggregator dates Gorev's and Wilson's exit to 12 April 2019. Triangle's articles of 17 April 2019, as quoted in the report, make directors nominated by Hulio and Lavie class B directors and those nominated by NorthPole Holdco through NorthPole Bidco class A directors, and let class B directors represent the company only if the board delegates its powers to them. ^{1 4}

analysisThe US lobbying registration that Mercury Public Affairs filed for Q Cyber described the same chain at the end of 2019. Exhibit A to Mercury Public Affairs' registration under the Foreign Agents Registration Act, received by the Justice Department on 25 December 2019, states that Q Cyber is wholly owned by OSY Technologies, which is wholly owned through intermediate holding companies by Square 2; that Square 2 is about 32% owned by Triangle Holding S.A. and about 68% by North Pole Holdco; that NorthPole is wholly owned by Novalpina Capital Partners I LuxCo, 99% owned by the ultimate parent, whose general partner is Novalpina Capital Partners I GP S.à r.l. That ultimate parent is the fund then called Novalpina Capital Partners I SCSp. ⁵

analysisOn 30 December 2019, according to Triangle's minutes as summarised in the report and an aggregator, NorthPole Holdco contributed all of its 484,808,020 Square 2 shares, 68.46% of Square 2's capital with a fair market value of USD 247,825,445, to Triangle in exchange for new class A, B and D shares. Square 2 became wholly owned by Triangle, which became the point of connection between Novalpina and NSO, and NorthPole Holdco's stake came to about 59.8% of Triangle's class A shares; register summaries show Triangle replacing NorthPole Holdco as Square 2's shareholder on 27 January 2020. The same day Triangle's shareholders appointed the Novalpina executives Mickaël Betito, Stefan Kowski, Stephen Peel, Maximilian Schmid Günter and Gerhard Schmidt as class A directors and reclassified Hulio and Lavie as class B directors, and on 27 April 2020 Triangle appointed Asher Levy, named NSO's executive chairman in early April 2020, as a class A director. ^{1 2}

analysisNSO Group described Novalpina's role to the report's authors in 2021: as a shareholder it appointed members to the boards of Triangle Holdings S.A. and OSY Technologies S.a.r.l. and their committees, which gave strategic direction, but it was not involved in the group's day-to-day operations. ¹

analysisAccording to register minutes summarised in the 2021 NGO report, on 30 November 2020 NorthPole Bidco contributed all its shares in Goatilev and NorthPole Newco to Emerald LIE for USD 326,800,326.27 in exchange for 350,000,000 new preferred B shares, and Emerald LIE passed the same shares to Diamond LIE that day, inserting both companies between NorthPole Bidco and NorthPole Newco. NSO Group said Emerald and Diamond were created to grant stock options to management, directors and employees. Register summaries record Emerald and then Diamond as NorthPole Newco's shareholder from 15 and 17 December 2020, and a publication of 24 February 2023 records Dufresne Holding in Diamond's place; Israeli business reporting attributed that change to the lenders' exercise of their rights under the loan agreements. ^{1 2}

analysisOn 5 February 2020 NorthPole Bidco acquired Goatilev Ltd., an Israeli shelf company that bought two Israeli companies in February and March 2020, according to NorthPole Bidco's accounts as quoted in the report. The report says Goatilev is reported to have bought Wayout, a company focused on router compromise and on intercepting data from Internet of Things devices; NSO Group confirmed that Wayout is an NSO Group company developing cyber security products for the IoT world for governmental use. ¹

analysisNorthPole Newco's 2024 accounts describe the financing. On 3 March 2019 its then sole shareholder entered into a credit agreement for a six-year term loan of up to USD 510,000,000 and a revolving facility of up to USD 30,000,000; under a joinder agreement of 8 April 2019 NorthPole Newco became the borrower and assumed the liability, a "debt pushdown". The term loan bore interest at the alternate base rate plus an initial margin of 7.00%. ¹

analysisIn May 2021 Moody's, describing NorthPole Newco as the top entity of NSO Group's restricted group, downgraded it from B2 to B3, together with its $300 million and €176.96 million senior secured term loans maturing in March 2025 and its $30 million revolving facility maturing in March 2024, with a negative outlook; the announcement is retained as republished by a human-rights resource centre on 25 May 2021. NorthPole Newco's accounts later record a forbearance agreement with the lenders of 31 December 2021 after certain events of default. ^{2 1}

analysisIsraeli business reporting in March 2022 described the roughly $500 million of debt as owed entirely by NorthPole Newco, with estimated annual interest of $65 million. It reported that days after NSO's US blacklisting Moody's cut the rating to Caa2, that a senior source said NSO did not feel exposed because the Israeli company had given no surety for the loan, and that the lenders it was told of included three main groups, Credit Suisse and the US hedge funds Senator Investment and Birch Grove Capital, alongside BlackRock, Ellington and Jefferies. Birch Grove Capital said it was not commenting, and Credit Suisse and Senator declined to comment. ³