Phishing attacks breach client data at four major Canadian law firms
Four major Canadian law firms had employee accounts and client-related data compromised through telephone and Microsoft Teams phishing attacks impersonating internal IT support staff. At McCarthy Tétrault, approximately 31,000 files, including client-related data, were stolen, and the firm discovered the incident on 22 October and notified affected parties, law enforcement and regulators. At Bennett Jones, two employee accounts were compromised, resulting in the theft of client-related revenue reports and some work description documents, while Borden Ladner Gervais brought in Mandiant to investigate a cloud breach.
Key facts
- Affected organisation
- McCarthy Tétrault
- Incident type
- Data breach
- Occurred / detected
- 2026-10-22
- Scale of damage
- Four major Canadian law firms breached; approximately 31,000 files stolen from McCarthy Tétrault
- Cause / method
- Access obtained through telephone and Teams phishing impersonating internal IT support staff and fake login pages
- Location
- Canada
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- McCarthy Tétrault discovered that an outside party had accessed some files containing client information.
- It was reported that McCarthy Tétrault had confirmed the incident and notified affected parties, law enforcement and regulators.
- Breaches at four Canadian law firms and the theft of approximately 31,000 McCarthy Tétrault files were reported.
- Bennett Jones confirmed data theft through two employee accounts and said its document management and accounting systems had not been compromised.
17 related reports
- McCarthy Tétrault hit by data breach exposing client files
- ALIAlert: Canadian Lawyers Targeted by Sophisticated Voice Phishing Attacks
- Corporate law firms McCarthy Tétrault and Davies hit by data breaches
- Law firms Baker McKenzie, Troutman targeted in cyber breaches
- Law firms face increasing AI-fueled cyberattacks, new report says
- Coordinated Cyberattack Hits Four Major Canadian Law Firms in October 2026
- Cyber Intrusion at Major Canadian Law Firms Exposes Vulnerabilities in Legal Data Security
- Four Bay Street Law Firms Breached in Coordinated Campaign
- How hackers broke into four of Canada’s top law firms, stole client files and caused chaos
- Bennett Jones, Borden Ladner Gervais hit in data breach targeting Bay Street law firms
- 4 Canadian Firms Fall Prey to Industry-Wide Cyberattack
- Bay Street Breach: 4 Law Firms, 31,000 Files [2026]
- Vishing Targets Canadian Law Firms: How Hackers Stole Thousands of Client Files
- Four Canadian Bay Street law firms breached in vishing campaign impersonating IT support
- Canadian law firms see increased cyberattacks, data breaches
- Several Canadian Firms Hit With Data Breaches
- Bennett Jones hit in data breach targeting Bay Street law firms
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.