--- title: "Fake IT calls expose client data at four Canadi… | Firevault" url: https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026 description: "Attackers posing as IT staff breached four major Canadian law firms, according to The Globe and Mail. The reported incidents underline the difference between…" lang: en-GB --- Breaking News Updated as information becomes available Image: AI-generated editorial illustration of an office telephone, laptop and legal files in a Canadian office (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg) News · Breach Analysis · Breaking # Fake IT calls expose client data at four Canadian law firms Attackers posing as IT staff breached four major Canadian law firms, according to The Globe and Mail. The reported incidents underline the difference between restoring files and protecting client confidentiality. Image: Mark Fermor, CTO, CMO and Founder of Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) **Mark Fermor**CTO, CMO and Founder, Firevault Published 31 October 2026 · 4 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcanadian-law-firms-voice-phishing-client-data-2026)Email ## What happened An apparently helpful call about a password or software update became a route into confidential legal information. The Globe and Mail reports that voice-phishing attacks breached four major Canadian law firms: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais (BLG). According to the newspaper, attackers contacted lawyers through telephone calls and Microsoft Teams, presenting themselves as internal IT staff. Urgency and a familiar-looking identity encouraged employees to follow instructions rather than independently verify the request. The reporting describes fraudulent sign-in pages capable of defeating the authentication arrangements in use. This does not mean every form of multifactor authentication is ineffective. Phishing-resistant authentication and independently verified support procedures remain important safeguards. ## What is known about the exposure The incidents did not affect every firm in the same way. The Globe reports four compromised employee accounts at McCarthy Tétrault, two at Bennett Jones and one at Davies. The number of compromised BLG accounts was not established in the report. A source cited by the newspaper said 31,000 files were stolen from McCarthy Tétrault. That is a reported file count, not a confirmed count of affected people or clients. Bennett Jones said its document management and accounting systems were not affected. The firm described compromised information as client revenue reports and, for certain clients, general descriptions of its mandates. BLG said an unauthorised third party accessed certain files, including client-related files. McCarthy Tétrault reported access to certain files containing client information; Davies described information compromised from one account. The full scope, attackers’ identities and subsequent use of the information remained unclear in parts of the reporting. These uncertainties should not be replaced with assumptions about ransomware, ransom payments or publication of stolen material. ## Why law firms are valuable targets Legal files can reveal transactions before announcement, litigation strategy, personal financial details and privileged communications. Losing control of those files can damage confidentiality even when working systems remain available. That distinction matters. A successful restoration does not retrieve information already copied by an attacker. Recovery planning and prevention of unnecessary exposure must therefore be treated as related but separate responsibilities. ## The practical response For legal practices, the immediate lessons are straightforward: - Verify unexpected IT requests through an established internal contact route, not the number or link supplied by the caller. - Use phishing-resistant authentication where supported and review account sessions after suspected compromise. - Limit access to client matters according to genuine working need, and review what each compromised account could reach. - Preserve evidence, establish the affected information and give clients accurate updates without speculating. - Test restoration and retain critical recovery copies separately from the environment being defended. These are Firevault recommendations, not claims that the affected firms lacked these controls. ## Where physical disconnection helps, and where it does not Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® keeps selected retained copies physically disconnected by default, with hardware-enforced isolation while disconnected. Authorised access uses a separate, non-IP connection-control process, and the connection is physically broken again when the session ends. A disconnected retained copy removes a live network path to that copy. It does not protect every working document in an online legal system, undo theft from a compromised account, or guarantee that an authorised access session cannot expose data. Secure endpoints, access controls, verified requests and tested recovery remain necessary. For law firms, the useful question is not whether every file can leave the working environment. It is which critical copies need to remain reachable all the time, and which can be retained offline until deliberately required. Explore offline protection for legal information: https://fire-vault.com/oss-for-legal. ## Source The Globe and Mail: How hackers broke into four of Canada’s top law firms, stole client files and caused chaos (https://www.theglobeandmail.com/business/article-law-firms-hackers-how-did-it-happen-client-files-voice-phishing/), by Tim Kiladze, Alexandra Posadzki and Andrew Willis, accessed 31 October 2026. Firm statements and incident figures above are attributed to that reporting; Firevault has not independently verified the incidents. _Analysis by Mark Fermor. Featured image is an AI-generated editorial illustration, not a photograph of the affected firms._ ## Questions The Globe and Mail names McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais. The scope differed between firms and remained under assessment. Voice phishing, or vishing, uses calls or voice conversations to impersonate a trusted person and persuade someone to disclose information or grant access. These attacks reportedly impersonated internal IT staff. No. A physically disconnected retained copy can support recovery and reduce network exposure of that copy while disconnected. It cannot reverse theft from live systems or replace confidentiality and access safeguards. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 30 Oct 2026**Binance hit by $6.3bn breach in what could be the biggest crypto heist on record**_Read the analysis_: https://fire-vault.com/news/binance-hack-biggest-crypto-heist-2026 - Breach Analysis · 21 Oct 2026**State Bank of India confirms data loss after 3,897 customer records found on the dark web**_Read the analysis_: https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026 - Breach Analysis · 21 Oct 2026**Cyberattack on cloud provider Arcadia may expose data of 125,000 Japanese police officers and staff**_Read the analysis_: https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026 - Breach Analysis · 15 Oct 2026**EY data breach: client tax records exposed through a support platform**_Read the analysis_: https://fire-vault.com/news/ey-data-breach-client-tax-records-october-2026 - Breach Analysis · 12 Oct 2026**ASOS data breach: stolen customer profiles and a hijacked app notification**_Read the analysis_: https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 - Breach Analysis · 25 Sept 2026**Dyfed-Powys Police confirms cyber attack as staff information may have been compromised**_Read the analysis_: https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Image: Offline Secure Storage icon (https://fire-vault.com/__l5e/assets-v1/a78723d3-5b1a-48bf-9040-c767b759823d/oss-icon-correct.png) Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Image: Control by Firevault icon (https://fire-vault.com/__l5e/assets-v1/9c97df8c-bca8-45bc-86f3-ec698db3afe8/control-icon.png) Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026#webpage", "url": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026", "name": "Fake IT calls expose client data at four Canadi…", "description": "Attackers posing as IT staff breached four major Canadian law firms, according to The Globe and Mail. The reported incidents underline the difference between…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Fake IT calls expose client data at four Canadian law firms", "item": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Fake IT calls expose client data at four Canadian law firms", "description": "Attackers posing as IT staff breached four major Canadian law firms, according to The Globe and Mail. The reported incidents underline the difference between restoring files and protecting client confidentiality.", "url": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/canadian-law-firms-voice-phishing-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-10-31T20:51:56.63611+00:00", "dateModified": "2026-10-31T20:51:56.63611+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 670, "keywords": "Fake, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened An apparently helpful call about a password or software update became a route into confidential legal information. The Globe and Mail reports that voice-phishing attacks breached four major Canadian law firms: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais (BLG). According to the newspaper, attackers contacted lawyers through telephone ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Which Canadian law firms were reportedly breached?", "acceptedAnswer": { "@type": "Answer", "text": "The Globe and Mail names McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais. The scope differed between firms and remained under assessment." } }, { "@type": "Question", "name": "What is voice phishing?", "acceptedAnswer": { "@type": "Answer", "text": "Voice phishing, or vishing, uses calls or voice conversations to impersonate a trusted person and persuade someone to disclose information or grant access. These attacks reportedly impersonated internal IT staff." } }, { "@type": "Question", "name": "Can an offline backup undo stolen client information?", "acceptedAnswer": { "@type": "Answer", "text": "No. A physically disconnected retained copy can support recovery and reduce network exposure of that copy while disconnected. It cannot reverse theft from live systems or replace confidentiality and access safeguards." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```