Bay Street towers in Toronto. The breaches occurred over the past week and affected parties are in the process of learning what information has been compromised.Nathan Denette/The Canadian Press
At least two of Canada’s leading corporate law firms, McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP, are dealing with data breaches that have compromised thousands of files in total, including client information.
The breaches occurred over the past week, the companies confirmed to The Globe and Mail. In McCarthy Tétrault’s case, one source directly involved said 31,000 files were stolen. At Davies, the breach resulted in the “compromise of information from one account,” the firm said.
The Globe and Mail is not naming its sources because they are not authorized to speak publicly about the matter.
McCarthy Tétrault and Davies, which advise on some of the highest-profile deals in Canada, have been reaching out to clients this week and informing them of the breaches. The affected parties are in the process of learning what information has been compromised.
The Globe reached out to seven other large corporate law firms, including each of the remaining Seven Sisters that dominate Bay Street business. Osler, Hoskin & Harcourt LLP, Goodmans LLP, Fasken Martineau DuMoulin LLP and Blake, Cassels & Graydon LLP all told The Globe they were not impacted.
Torys LLP declined to comment, and Bennett Jones LLP and Stikeman Elliott LLP did not return requests for comment.
As leading corporate law firms, McCarthy Tétrault and Davies advise on mergers and acquisitions and share sales, which means their servers could have confidential information about deals that have yet to be announced.
The firms also have large litigation and restructuring practices, and private communication between the firms and their clients is also on their servers.
In a Thursday statement, McCarthy Tétrault said it caught the breach late on Oct. 22 and that it quickly worked with a cybersecurity firm to determine the extent and scope of the unauthorized activity. The firm declined to comment on the number of affected files.
“The investigation has since identified that an unauthorized third party gained access to certain files, including information relating to clients,” McCarthy Tétrault said in its statement.
“We sincerely regret the concern this incident may have caused our clients, our people and the organizations we work with,” the firm added.
Davies told The Globe that a cyberattack on Oct. 23 resulted in the data breach, and that it also engaged cybersecurity experts to understand the extent of the problem.
“Protecting the privacy and confidentiality of our clients’ information is one of our highest priorities, and we sincerely regret that this incident has occurred. We appreciate the importance of this matter and are treating it with the utmost seriousness,” the firm said.
Both McCarthy Tétrault and Davies have notified law enforcement.
Cyberattacks have become an increasingly pervasive and costly problem for organizations. Attackers have started leveraging artificial intelligence tools to exploit vulnerabilities in code and to also make their impersonation attempts more convincing.
The cybersecurity risks posed by powerful new AI models have rankled regulators around the world in recent months, raising concerns about the stability of financial systems and other critical infrastructure.
Canada’s federal cybersecurity agency recently cautioned that agentic AI is accelerating cyberthreats on an industrial scale. (Agentic AI agents are systems that can make decisions and use external tools with limited human supervision or instruction.)
Older techniques, such as phishing scams, also remain prevalent and were used in at least some of the law firm breaches, according to two sources.
To gain access to law firm files, hackers in some cases used Microsoft Teams and posed as internal IT employees to request access to an employee’s computer, according to one of the sources.
On Wednesday, the Canadian Centre for Cyber Security, which is an arm of the federal government, put out a notice alerting Canadians to a new phishing scam targeting Canadian firms, “including organizations in the legal and financial sectors.”
At the time, it was not clear if the attacks the alert referenced were successful. However, a third source familiar with the recent law firm cases said the alert was indeed spurred by the breaches.
“Multiple Canadian firms have been targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages,” the alert said, adding that hackers have been increasingly targeting finance and legal organizations since July, “with October activity concentrated on the legal sector.”
Getting technical, the agency said the current hacking campaign “bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains, limiting the effectiveness of blocklists.”