Canadian Law Firm Breaches (October 2026): IT Impersonation Calls

What was reported

Over the last week of October 2026, four of Canada’s largest law firms confirmed to The Globe and Mail that outsiders had reached client files. McCarthy Tétrault and Davies Ward Phillips & Vineberg were named first, on 29 October. Bennett Jones and Borden Ladner Gervais (BLG) followed on 30 October. The ABA Journal summarized the four breaches on 2 November.

Firm by firm

McCarthy Tétrault said it detected the breach late on 22 October. Its statement said “an unauthorized third party gained access to certain files, including information relating to clients.” It declined to say how many files were affected. One unnamed source told the Globe the figure was 31,000, which we treat as unconfirmed.

Davies said a cyberattack on 23 October led to the “compromise of information from one account.”

Bennett Jones said two business services employees’ accounts were compromised on 19 October as part of a “larger campaign targeting Canadian law firms.” The stolen data includes client revenue reports and, in some cases, general descriptions of client mandates. It said its document management and accounting systems were not breached.

BLG said an unauthorized party accessed a portion of its Microsoft cloud environment, including client-related files. It hired Mandiant to investigate.

All four told the Globe they had notified law enforcement and were contacting affected clients. The ABA Journal reports the firms say the damage is contained.

How the attacks reportedly worked

The Globe’s sources said phishing was used in at least some cases. Hackers reportedly posed as internal IT staff on Microsoft Teams and asked employees to give access to their computer or visit fraudulent sign-in pages. The firms have not confirmed these methods for their own incidents.

On 28 October the Canadian Centre for Cyber Security issued alert AL26-028 about a help desk voice phishing campaign. It says callers pose as internal IT or help desk staff and claim an urgent passkey migration, MFA enrolment or password change is needed. Calls may come to personal or office phones or to Teams, sometimes with spoofed help desk numbers. Employees are sent to an organization-branded page that relays credentials and MFA responses to the real identity provider, which hands the attacker an authenticated session. The alert says October activity concentrated on the legal sector.

After access, the alert says the actor registers its own MFA method, deletes password-reset and security notification emails, uses Microsoft Graph scripts to take data from Microsoft 365, SharePoint and OneDrive, and may send extortion demands.

Why the data matters

The Globe noted that these firms advise on mergers, acquisitions and share sales, so their systems may hold confidential information about unannounced deals, plus private communications from litigation and restructuring work.

What clients and staff should do

Clients should wait for the firm’s notice and ask what was involved. Staff should never act on an unexpected IT call about MFA. Read our guide to vishing and callback phone scams, our phishing messages guide and the data breach checklist.

A related campaign against managed service providers is covered in the Todyl report.

This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.