---
title: Help-desk vishing breached four top Canadian law firms: McCarthy Tétrault, Davies, Bennett Jones and BLG confirm client-related files were accessed | ctxsec
url: https://ctxsec.com/items/canada-law-firms-vishing-breaches-mccarthy-davies-bennett-jones-blg
description: "The Globe and Mail reports that callers posing as internal IT on Teams and phone sent lawyers to MFA-bypassing sign-in pages, compromising at least seven accounts across McCarthy T\u00e9trault, Davies, Bennett Jones and Borden Ladner Gervais from about Oct 22. All four firms issued statements confirming unauthorized access to some files or accounts. This matches the Cyber Centre's Oct 28 AL26-028 warning about help-desk vishing against Canadian legal firms."
status: "firm statements (via The Globe and Mail, Oct 31); file counts from an unnamed source"
published: 2026-11-01
---

> The Globe and Mail reports that callers posing as internal IT on Teams and phone sent lawyers to MFA-bypassing sign-in pages, compromising at least seven accounts across McCarthy Tétrault, Davies, Bennett Jones and Borden Ladner Gervais from about Oct 22. All four firms issued statements confirming unauthorized access to some files or accounts. This matches the Cyber Centre's Oct 28 AL26-028 warning about help-desk vishing against Canadian legal firms.

[← Cybersecurity News](/news) · [markdown](/items/canada-law-firms-vishing-breaches-mccarthy-davies-bennett-jones-blg.md)

firm statements (via The Globe and Mail, Oct 31); file counts from an unnamed source

2026-11-01

### Help-desk vishing breached four top Canadian law firms: McCarthy Tétrault, Davies, Bennett Jones and BLG confirm client-related files were accessed

The Globe and Mail detailed on **Oct 31** how a help-desk **vishing** campaign broke into four of Canada's largest law firms. Callers posed as internal IT staff on Microsoft Teams or from the IT department's number, claiming an urgent software update or expired password, and steered staff to fraudulent sign-in pages able to bypass MFA.

- **Firm statements:** McCarthy Tétrault said a third party "gained access to certain files, including information relating to clients"; Davies identified "the compromise of information from one account"; BLG said "certain files, including files related to clients, were accessed"; Bennett Jones said its document management and accounting systems were not affected, but client revenue reports and some mandate descriptions were.
- **Scale:** at least seven employee accounts were compromised (McCarthy 4, Bennett Jones 2, Davies 1, BLG unknown), per the Globe's reporting confirmed by the firms. McCarthy was hit on Oct 22 and Davies on Oct 23. The figure of 31,000 files stolen from McCarthy comes from an unnamed source and is unconfirmed.
- **Response:** McCarthy engaged CrowdStrike and BLG engaged Mandiant. Attribution has not been made public.

**Context:** the Canadian Centre for Cyber Security's **AL26-028** (Oct 28, on this site) describes the same playbook: AiTM pages named like `<org>sso[.]com`, attacker-registered MFA devices, deleted security notices, and bulk SharePoint/OneDrive pulls followed by extortion. **What to do:** move lawyers and assistants to phishing-resistant MFA, require out-of-band verification before any IT-initiated password or MFA change, restrict external Teams calling to known partners, and alert on new MFA registrations followed by bulk Graph file access.

Sources: [The Globe and Mail: How hackers broke into four of Canada's top law firms (Oct 31)](https://www.theglobeandmail.com/business/article-law-firms-hackers-how-did-it-happen-client-files-voice-phishing/) · [Canadian Centre for Cyber Security AL26-028 (Oct 28)](https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations)