News · Breach Analysis · Breaking

Fake IT calls expose client data at four Canadian law firms

Attackers posing as IT staff breached four major Canadian law firms, according to The Globe and Mail. The reported incidents underline the difference between restoring files and protecting client confidentiality.

What happened

An apparently helpful call about a password or software update became a route into confidential legal information. The Globe and Mail reports that voice-phishing attacks breached four major Canadian law firms: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais (BLG).

According to the newspaper, attackers contacted lawyers through telephone calls and Microsoft Teams, presenting themselves as internal IT staff. Urgency and a familiar-looking identity encouraged employees to follow instructions rather than independently verify the request.

The reporting describes fraudulent sign-in pages capable of defeating the authentication arrangements in use. This does not mean every form of multifactor authentication is ineffective. Phishing-resistant authentication and independently verified support procedures remain important safeguards.

What is known about the exposure

The incidents did not affect every firm in the same way. The Globe reports four compromised employee accounts at McCarthy Tétrault, two at Bennett Jones and one at Davies. The number of compromised BLG accounts was not established in the report.

A source cited by the newspaper said 31,000 files were stolen from McCarthy Tétrault. That is a reported file count, not a confirmed count of affected people or clients.

Bennett Jones said its document management and accounting systems were not affected. The firm described compromised information as client revenue reports and, for certain clients, general descriptions of its mandates. BLG said an unauthorised third party accessed certain files, including client-related files. McCarthy Tétrault reported access to certain files containing client information; Davies described information compromised from one account.

The full scope, attackers’ identities and subsequent use of the information remained unclear in parts of the reporting. These uncertainties should not be replaced with assumptions about ransomware, ransom payments or publication of stolen material.

Why law firms are valuable targets

Legal files can reveal transactions before announcement, litigation strategy, personal financial details and privileged communications. Losing control of those files can damage confidentiality even when working systems remain available.

That distinction matters. A successful restoration does not retrieve information already copied by an attacker. Recovery planning and prevention of unnecessary exposure must therefore be treated as related but separate responsibilities.

The practical response

For legal practices, the immediate lessons are straightforward:

• Verify unexpected IT requests through an established internal contact route, not the number or link supplied by the caller.
• Use phishing-resistant authentication where supported and review account sessions after suspected compromise.
• Limit access to client matters according to genuine working need, and review what each compromised account could reach.
• Preserve evidence, establish the affected information and give clients accurate updates without speculating.
• Test restoration and retain critical recovery copies separately from the environment being defended.

These are Firevault recommendations, not claims that the affected firms lacked these controls.

Where physical disconnection helps, and where it does not

Offline Secure Storage® keeps selected retained copies physically disconnected by default, with hardware-enforced isolation while disconnected. Authorised access uses a separate, non-IP connection-control process, and the connection is physically broken again when the session ends.

A disconnected retained copy removes a live network path to that copy. It does not protect every working document in an online legal system, undo theft from a compromised account, or guarantee that an authorised access session cannot expose data. Secure endpoints, access controls, verified requests and tested recovery remain necessary.

For law firms, the useful question is not whether every file can leave the working environment. It is which critical copies need to remain reachable all the time, and which can be retained offline until deliberately required.

Explore offline protection for legal information.

Source

The Globe and Mail: How hackers broke into four of Canada’s top law firms, stole client files and caused chaos, by Tim Kiladze, Alexandra Posadzki and Andrew Willis, accessed 31 October 2026. Firm statements and incident figures above are attributed to that reporting; Firevault has not independently verified the incidents.

Analysis by Mark Fermor. Featured image is an AI-generated editorial illustration, not a photograph of the affected firms.