Thales Gemalto: a High Sensitivity Matter (HSM)

On February 22, Thales announced it had sold its General Purpose Hardware Security Module (GP HSM) business to Entrust Datacard. This activity, the nShield range, was operated as a separate stand-alone business within Thales since January 2019 under the brand “nCipher Security.” As of now, Thales and Entrust Datacard have signed a definitive agreement and they expect to complete the transaction in Q2/2019, subject to the completion of the acquisition of Gemalto by Thales and approval by various competition authorities. Financial details of the transaction have not been disclosed.

Thales HSM activity has been offered for sale for a few months, under pressure from competition authorities, which made it a prerequisite before authorizing the acquisition of Gemalto. It has been known in the industry that there was several contenders, including several European companies, proposing to acquire the GP HSM division from Thales. However, some analysts notice that an American acquirer for this activity has been preferred. As a result, on March 1st, Thales and Gemalto announced that an agreement had been reached with the Antitrust Division of the US Department of Justice (DoJ) that will allow the companies to proceed with the considered acquisition. Now, Thales and Gemalto expect to complete the transaction in March 2019.

This announcement comes after the planned acquisition of Gemalto by Thales has been under fire from competition authorities which criticized the potential dominant position of a combined entity Thales-Gemalto in the HSM business. In fact, HSMs can be categorized in “Payment HSMs,” dedicated to payment, and “General Purpose (GP) HSMs” which target applications such as identity and IoT.

Thales had acquired nCipher, including its General Purpose HSM activity, in 2008 for US$ 100 million (EUR 87 million) while Gemalto acquired SafeNet, including its HSM activity, in 2014 for US$ 809 million (EUR 704 million). These acquisitions led Gemalto and Thales to become global leaders in the HSM market.

Thales’ nCipher Security employs over 300 people and it has achieved a EUR 100 million revenue in 2018, says Thales. Entrust Datacard has over EUR 500 million annual revenue, running a wide diversity of business including Public Key Infrastructure (PKI) solutions, where HSMs are a core component of their solutions, and an underlying part of the security infrastructure of the company’s public key infrastructure (PKI) and secure socket layer (SSL) offerings. Entrust Datacard also offers services including payment card issuance, authentication solutions, government ID, solutions for education, retail, mass transit, and more.

Thales eSecurity activity in on a path to become an increasingly strong player in the cybersecurity world through a series of acquisitions. Besides Gemalto, the company has also acquired Guavus, a specialist in processing and predictive analysis of “big data” for US$ 215 million (EUR 187 million), in 2017. Earlier, in 2016, Thales acquired Vormetric, a leader in data protection solutions in physical, virtual and cloud infrastructures, for US$ 400 million (EUR 348 million). And, even earlier, in 2014, Thales acquired Alcatel Lucent’s cybersecurity and communications security business.

Thanks to the combination of this acquisition series with its own internal developments and long-standing history in security expertise, Thales is increasingly showing its will to position itself among the cybersecurity giants of this world.