No software exploit has been reported. In October, attackers got into four of Canada’s top law firms by calling and messaging staff while posing as IT, then walking them to fake sign-in pages. At least seven employees went along. The technique is well documented, and so are the controls that stop it. That is the uncomfortable part.
What happened
At least seven employee accounts were compromised across McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais, according to The Globe and Mail and the firms’ own statements. The three firms that have dated their breaches put them between October 19 and 23. McCarthy Tétrault had four accounts compromised; one source directly involved told the Globe that 31,000 files were stolen, a figure the firm declined to confirm. The Globe reports Stikeman Elliott and Gowling WLG were also targeted but not breached.
| Firm | Compromised | Accounts | What the firm or the Globe has said | Investigator |
|---|---|---|---|---|
| McCarthy Tétrault | Oct 22 | 4 | Third party accessed files including client information; ~31,000 files per one unnamed source | CrowdStrike |
| Davies Ward Phillips & Vineberg | Oct 23 | 1 | “Compromise of information from one account” | Outside experts, not named |
| Bennett Jones | Oct 19 | 2 (business services staff) | Part of a “larger campaign targeting Canadian law firms” | Not disclosed |
| Borden Ladner Gervais | Not disclosed | Not disclosed | Files, including client files, accessed by an unauthorized third party | Mandiant |
The Globe reports staff got urgent calls and Teams messages from people posing as IT, about a critical update or an expired password. Those who followed instructions were sent to fraudulent sign-in pages capable of bypassing MFA, and in some cases attackers asked for remote access to the employee’s computer.
On October 28 the Canadian Centre for Cyber Security issued alert AL26-028 on the same campaign. It describes callers spoofing help-desk caller ID, reaching staff by phone and Teams, pushing an urgent passkey or MFA “enrolment,” and relaying credentials and MFA responses to the real sign-in page in real time. The Cyber Centre says targeting shifted to finance and legal from July, with October concentrated on the legal sector. The RCMP’s National Cybercrime Coordination Centre has issued a similar warning through the law societies.
No group has been publicly named. No extortion demand against these four firms has been reported, though the Cyber Centre says actors in this campaign send extortion demands after stealing data. For corporate law firms the exposure is the files themselves: M&A mandates, unannounced deals and privileged advice.
What likely went wrong
None of the four firms has published a root cause, so this is an informed read rather than a finding. It is based on the methods the Cyber Centre and the Globe describe. Each step the attackers needed is a control that could have held.
- Outsiders could reach staff directly. The attackers used Teams as well as phone. By default, Teams lets users chat with external organizations unless an admin restricts it. The Cyber Centre now recommends limiting external messages, calls and meeting invites to trusted partners.
- The MFA could be relayed. The Cyber Centre describes adversary-in-the-middle pages that pass the user’s password and MFA response to the real sign-in in real time, handing the attacker a live session. Push approvals and one-time codes do not stop that. FIDO2 keys and passkeys do, because they will not authenticate to a lookalike domain.
- There was no safe way to check “IT”. The callers pushed urgency and, per the Cyber Centre, may hang up when an employee tries to verify. Without a standing rule to hang up and call the service desk back on a known number, a spoofed caller ID is convincing. Cybersecurity lawyer Brent Arnold told the Globe these attacks exploit how few colleagues people at large firms actually know, and how little time busy people have to question a request.
- One account could reach a lot. If the 31,000-file figure is accurate, four accounts exposed a large volume. The Cyber Centre says actors in this campaign use scripts and Microsoft Graph to pull data from SharePoint and OneDrive. The firms have not said how long the attackers had access before they were cut off.
None of this is unique to law firms. It is a Microsoft 365 configuration problem, and many mid-sized Canadian businesses run the same defaults.
How it could have been prevented
The Cyber Centre’s first recommendation is phishing-resistant MFA, and Google’s threat researchers have said the same about this wave of vishing. Most of the other controls below are configuration changes. They track the Cyber Centre’s alert.
| Control | What it stops | Effort |
|---|---|---|
| Phishing-resistant MFA (FIDO2 keys, device-bound passkeys, Windows Hello for Business), high-risk users first | Credentials and MFA relayed through a fake sign-in page | Medium |
| Conditional Access: managed devices only; block sign-ins from commercial VPNs, hosting providers and residential proxies | A relayed session being used from the attacker’s infrastructure | Medium |
| Stricter checks on MFA resets, account recovery and new-device enrolment | Attackers registering their own MFA method to keep access | Low |
| Restrict external Teams chat, calls and meeting invites to trusted domains; review guest access | Fake “IT” reaching staff on Teams | Low |
| Restrict remote-support tools such as Quick Assist | An outsider getting hands-on access to a laptop | Low |
| Written rule: hang up and call IT back on a known number, whatever the caller ID says | The social engineering itself | Low |
| Matter-based access in document management | One account exposing large volumes of files | Medium to high |
| Alerts on new MFA registrations, scripted or high-volume Microsoft 365 file access, and deleted security emails | Quiet persistence and bulk exfiltration | Low to medium |
| Shorter session lifetimes; revoke sessions on risk | A stolen session staying useful | Low |
Training helps, but it is the last line, not the first. If your security depends on every busy partner spotting a convincing fake on a Friday afternoon, it will fail eventually. Put the controls in front of the person.
After the breach: where Sentry fits
Once files are gone, the question changes from “how did they get in” to “where is our data now, and who is coming next.” Incident response firms answer the first. Continuous outside-in monitoring answers the second. Full disclosure: Sentry is the OSINT platform we build at Confidion, so read this with that in mind.
Watching for the stolen files. Sentry monitors dark web sources and Telegram channels for the firm’s name, client names and matter names. If stolen files are offered for sale or leaked, the firm hears about it early, not from a reporter or a client.
Spotting lookalike sign-in domains. The Cyber Centre lists newly registered lookalike domains as a detection signal. It says this campaign’s domains pair the organization’s name with words like “sso,” “mfa,” “passkey” or “register,” either as a new domain or as a subdomain of a generic one. Sentry’s attack-surface monitoring watches certificate transparency logs and DNS/WHOIS for names that match those patterns. Lure domains rotate quickly, so this works best as an early-warning feed to the security team, not a blocklist.
Mapping the actors. Sentry’s entity graph links domains, IPs, handles and channels across sources. When the same infrastructure or Telegram persona shows up against multiple firms, that pattern is visible, and it can be shared with peers and the Cyber Centre.
Protecting clients and reputation. Clients will want to know whether their deal information is exposed. Monitoring news, social and underground chatter on client and deal names gives the firm facts for those conversations, and early notice if a pending transaction starts leaking.
Knowing who is likely to be targeted. Attackers pick busy, senior, publicly visible people. An OSINT review of what a firm’s partners and IT staff expose online (titles, phone numbers, org charts, conference bios) shows the target list the attackers are already using.
To be clear about the limits: Sentry does not stop someone typing a password into a fake page. That is the job of the controls above. What it does is shorten the time between an attacker’s preparation, or a data dump, and the firm knowing about it.
The takeaway for everyone else
If four of the best-resourced firms on Bay Street can lose files to a phone call, a mid-sized business running default Microsoft 365 settings is an easier target. Check three things this week: is your MFA phishing-resistant, can outsiders message your staff on Teams, and would you know if an account started pulling thousands of files from SharePoint tonight?
Sources
- AL26-028: Ongoing help desk voice phishing campaign targeting Canadian organizations, Canadian Centre for Cyber Security, October 28, 2026
- Corporate law firms McCarthy Tétrault and Davies hit by data breaches, The Globe and Mail
- Bennett Jones, Borden Ladner Gervais hit in data breach targeting Bay Street law firms, The Globe and Mail
- How hackers broke into four of Canada’s top law firms, The Globe and Mail
- Fraud Alert: RCMP identifies cyber threat targeting Canadian law firms, Nova Scotia Barristers’ Society