Four of Canada's biggest law firms have been hit in a coordinated voice-phishing campaign that put client files in attackers' hands, according to reports in The Globe and Mail and Law.com. McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais (BLG) were all compromised, with the campaign moving across Toronto's Bay Street legal district within days. Bennett Jones told the Globe that two accounts belonging to business services employees were compromised on 19 October, McCarthy Tétrault detected an intrusion late on 22 October, and Davies was hit on 23 October.

Fake IT calls bypassed login security

The attackers did not exploit a software flaw. Instead, they called and messaged staff while posing as internal IT, then steered at least seven employees to fake sign-in pages. Canada's Centre for Cyber Security warned on 28 October, in alert AL26-028, that just such a campaign was targeting legal and financial organisations: callers claim an urgent passkey migration or password change is needed, then send staff to a branded fake login page that relays the password and the multi-factor authentication response in real time, bypassing conventional login security. Once inside, the attackers can register their own authentication method, delete security notification emails and pull data from Microsoft 365, including SharePoint and OneDrive, for extortion.

The Globe reported that 31,000 files were taken from four accounts at McCarthy Tétrault, a figure it attributed to an unnamed source directly involved; the firm confirmed a breach but declined to comment on the number, so it should be treated as reported rather than firm-confirmed. All four firms say the damage has been contained and affected parties are being alerted. Two other firms, Stikeman Elliott and Gowling WLG, were targeted but have not confirmed a compromise.