At least four of Canada's largest corporate law firms are dealing with data breaches tied to what one firm calls "a wider campaign of activity targeting Canadian law firms.":
McCarthy Tetrault LLP and Davies Ward Phillips & Vineberg LLP confirmed their incidents to The Globe and Mail, and Borden Ladner Gervais (BLG) and Bennett Jones have since been named as victims. All four say the damage has been contained and affected clients are being contacted.
What the firms have confirmed
McCarthy Tetrault says it detected the intrusion late on Oct. 22 and brought in an outside cybersecurity firm to scope the activity. Its investigation found that an unauthorized third party accessed files that include client information. The firm has not said how many files were involved, but a source directly involved in the response told The Globe that 31,000 files were stolen.
Davies says a cyberattack on Oct. 23 led to "the compromise of information from one account." BLG says it found limited unauthorized access to part of its Microsoft cloud environment and confirmed that files, including client files, were viewed by an outside party. McCarthy Tetrault and Davies say they have notified law enforcement.
Several other Bay Street firms, including Osler, Goodmans, Fasken and Blakes, told The Globe they were not affected.
How the attackers got in
The firms have not published full technical details, but sources told The Globe that phishing was used in at least some of the breaches. In some cases attackers contacted employees on Microsoft Teams, posed as internal IT staff and asked for access to their computers.
That matches an alert the Canadian Centre for Cyber Security issued on Oct. 28 (AL26-028). The Cyber Centre warned of an ongoing voice phishing campaign in which callers pretend to be the help desk and send employees to fake sign-in pages. Those pages pass the victim's password and MFA response to the real service in real time, so the attacker ends up with a fully authenticated session. The agency says activity has focused more and more on legal and financial organizations since July, and that in October it has concentrated on the legal sector.
Why this matters beyond law firms
Law firms hold merger documents, litigation strategy, privileged communications and personal client data, which makes them a high-value target for both extortion groups and espionage actors. A breach at outside counsel can expose a client's most sensitive material even when the client's own network is secure.
Companies that use any of the affected firms should ask counsel directly whether their matters were in scope, what data was involved and what notifications will follow. Every organization should treat this campaign as a test of its own help desk: the attack does not rely on a software flaw, only on an employee trusting a caller who sounds like IT.
