The Globe and Mail detailed on Oct 31 how a help-desk vishing campaign broke into four of Canada's largest law firms. Callers posed as internal IT staff on Microsoft Teams or from the IT department's number, claiming an urgent software update or expired password, and steered staff to fraudulent sign-in pages able to bypass MFA.

• Firm statements: McCarthy Tétrault said a third party "gained access to certain files, including information relating to clients"; Davies identified "the compromise of information from one account"; BLG said "certain files, including files related to clients, were accessed"; Bennett Jones said its document management and accounting systems were not affected, but client revenue reports and some mandate descriptions were.
• Scale: at least seven employee accounts were compromised (McCarthy 4, Bennett Jones 2, Davies 1, BLG unknown), per the Globe's reporting confirmed by the firms. McCarthy was hit on Oct 22 and Davies on Oct 23. The figure of 31,000 files stolen from McCarthy comes from an unnamed source and is unconfirmed.
• Response: McCarthy engaged CrowdStrike and BLG engaged Mandiant. Attribution has not been made public.

Context: the Canadian Centre for Cyber Security's AL26-028 (Oct 28, on this site) describes the same playbook: AiTM pages named like <org>sso[.]com, attacker-registered MFA devices, deleted security notices, and bulk SharePoint/OneDrive pulls followed by extortion. What to do: move lawyers and assistants to phishing-resistant MFA, require out-of-band verification before any IT-initiated password or MFA change, restrict external Teams calling to known partners, and alert on new MFA registrations followed by bulk Graph file access.