{"id":952674,"date":"2026-10-31T03:46:13","date_gmt":"2026-10-31T03:46:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/952674\/"},"modified":"2026-10-31T03:46:13","modified_gmt":"2026-10-31T03:46:13","slug":"how-hackers-broke-into-four-of-canadas-top-law-firms-stole-client-files-and-caused-chaos","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/952674\/","title":{"rendered":"How hackers broke into four of Canada\u2019s top law firms, stole client files and caused chaos"},"content":{"rendered":"

Open this photo in gallery:<\/a><\/p>\n

The companies broken into include McCarthy T\u00e9trault LLP, Davies Ward Phillips & Vineberg LLP, Bennett Jones LLP and Borden Ladner Gervais LLP.Nathan Denette\/The Canadian Press<\/p>\n

One week ago, lawyers at Canada\u2019s top firms received urgent calls from their IT departments about a critical software update or an expired password. The agents were happy to stay on the phone and help.<\/p>\n

Even to a skeptic, the calls could seem legitimate. They were often placed through Microsoft Teams, appearing to come from internal IT employees, or they were phone calls from the IT department\u2019s number.<\/p>\n

The reality: Hackers were on the other end, spamming Canadian lawyers en masse. <\/p>\n

The tactic the hackers used is called vishing, short for voice phishing \u2013 and it worked. At least four companies were broken into<\/a>, all among the country\u2019s most prestigious law firms: McCarthy T\u00e9trault LLP, Davies Ward Phillips & Vineberg LLP, Bennett Jones LLP and Borden Ladner Gervais LLP.<\/p>\n

The extent of the damage is still being assessed, but the fallout is already immense. Law firms market themselves as trusted advisers, and the nature of their work means they store sensitive files on their servers. These include non-public corporate information, communication between client and counsel, and their clients\u2019 tax, financial or health records.<\/p>\n

Because so much sensitive information is potentially exposed \u2013 at McCarthy T\u00e9trault, 31,000 files were stolen<\/a>, according to a source directly involved \u2013 some clients are extremely concerned, but so far remain in the dark. Lawyers at the hacked firms have been told which clients were affected, but specific details are often still coming, according to four sources and communication reviewed by The Globe and Mail.<\/p>\n

Still unknown in some cases, according to one of the sources: the hackers\u2019 identities, how they\u2019re using the stolen information, and whether the firms are monitoring the web for leaked data or have found any yet. <\/p>\n

The Globe is not identifying the sources because they are not authorized to speak publicly about the data breaches.<\/p>\n

There\u2019s also a fear of more breaches to come. Hackers are increasingly targeting law firms, and the Canadian hack proves even the largest firms with the most sophisticated technology can\u2019t always ward them off. What the top firms spend on hacking defences would likely exceed the annual revenues of scores of smaller boutiques across Canada that specialize in practice areas such as employment and family law. <\/p>\n

Across the four firms that were breached, at least seven employees granted the hackers access to internal files, according to The Globe\u2019s reporting and confirmed by the respective firms. McCarthy T\u00e9trault had four employee accounts compromised; Bennett Jones had two; Davies had one. It is unclear how many users were compromised at BLG.<\/p>\n

Hackers steal $6.3-billion from Binance in record heist blamed on North Korea<\/a><\/p>\n

Gone in 20 minutes: How the biggest heist in crypto history unfolded at Binance<\/a><\/p>\n

The depth of the breaches varied. At Bennett Jones, the firm\u2019s document management system, used to protect client legal files and work product, was not affected, the firm said Friday. Its accounting system was also unaffected. <\/p>\n

\u201cThe compromised information included reports on revenue from clients; for certain clients, general descriptions of our mandates for them were also involved and as we identify those clients, we will contact them directly,\u201d Bennett Jones said in a statement.<\/p>\n

At BLG, an internal investigation confirmed that \u201ccertain files, including files related to clients, were accessed by an unauthorised third party,\u201d the firm said Friday in a statement. <\/p>\n

On Thursday, McCarthy T\u00e9trault said a third party \u201cgained access to certain files, including information relating to clients,\u201d while Davies said Thursday it identified \u201cthe compromise of information from one account.\u201d McCarthy T\u00e9trault was hacked on Oct. 22 and Davies was hacked on Oct. 23.<\/p>\n

Vishing attacks are a form of social engineering in which cybercriminals use telephone calls or voice messages to trick victims into giving them access to accounts or sharing sensitive information.<\/p>\n

Opinion: France\u2019s melted freezers hack can happen in Canada, too<\/a><\/p>\n

Targeting law firms by impersonating IT employees takes advantage of the fact that people at large companies are unlikely to know all of their co-workers, said Brent Arnold, a cybersecurity<\/a> lawyer and the founder and principal of Capstan Legal. On top of that, turnover in an IT department can be high.<\/p>\n

\u201cThe anonymity of working in a really big organization makes it easier to pull this off, because it comes in on your Teams, it looks legitimate, it sounds boring enough that it\u2019s probably real,\u201d Mr. Arnold said.<\/p>\n

\u201cThat\u2019s part of why it\u2019s working \u2013 you\u2019re exploiting the weakness of a large organization where not everybody knows each other,\u201d he added.<\/p>\n

Mr. Arnold said these types of attacks often fool higher-level employees. They\u2019re more likely to skip cybersecurity training, and are \u201calways in a hurry,\u201d giving them less time to question whether what they\u2019re seeing is legitimate. \u201cBusy people are easier to exploit.\u201d<\/p>\n

With technological advances, hackers are getting more sophisticated and learning to find their ways into organizations that have defences in place, such as multifactor authentication (MFA).<\/p>\n

In the law firm breaches, employees who followed the hackers\u2019 instructions were directed to fraudulent sign-in pages capable of bypassing MFA. In a recent security warning, researchers at Google wrote that the rise of these vishing campaigns \u201cunderscores the critical importance of organizations moving toward phishing-resistant MFA\u201d to protect their systems. <\/p>\n

Agentic AI linked to rise in cyberattacks, Canada\u2019s cybersecurity agency says<\/a><\/p>\n

In Canada, law firms and IT departments are working together to understand how the hackers got access to confidential data, what to do to help clients and how to ensure it doesn\u2019t happen again.<\/p>\n

\u201cAll the major law firms, and in particular all the CIOs [chief information officers], are sharing intel and best practices,\u201d Peter Castiel, Montreal-based chair of Stikeman Elliott LLP, said in an interview. (Stikeman was recently targeted by hackers, but was not breached.)<\/p>\n

Mr. Castiel said lawyers are being urged to explain the full extent of the problem to clients, as well as steps being taken to fix the issues. Regarding client relationships, he said: \u201cThe first and most important step is being completely transparent.\u201d <\/p>\n

McCarthy\u2019s has brought in cybersecurity firm CrowdStrike of Austin, Tex., to investigate, while BLG has engaged Mandiant, a cybersecurity consulting firm and Google subsidiary.<\/p>\n","protected":false},"excerpt":{"rendered":"Open this photo in gallery: The companies broken into include McCarthy T\u00e9trault LLP, Davies Ward Phillips & Vineberg…\n","protected":false},"author":2,"featured_media":952675,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[901,888,902,879,877,903,45,49,48,876,895,896,891,878,875,46,549,295,894,887,914,880,881,893,889,890,884,904,885,909,910,912,907,911,905,908,882,898,899,714,897,906,865,61,900,892,886,883,913],"class_list":["post-952674","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-alberta","tag-arts-news","tag-bc","tag-breaking-news","tag-breaking-news-video","tag-british-columbia","tag-business","tag-ca","tag-canada","tag-canada-news","tag-canada-sports","tag-canada-sports-news","tag-canada-trafficcanada-weather","tag-canadian-breaking-news","tag-canadian-news","tag-economy","tag-education","tag-environment","tag-federal-government","tag-foreign-news","tag-globe-and-mail","tag-globe-and-mail-breaking-news","tag-globe-and-mail-canada-news","tag-government","tag-life-news","tag-lifestyle","tag-local-news","tag-manitoba","tag-national-news","tag-new-brunswick","tag-newfoundland-and-labrador","tag-northwest-territories","tag-nova-scotia","tag-nunavut","tag-ontario","tag-pei","tag-photos","tag-political-news","tag-political-opinion","tag-politics","tag-politics-news","tag-quebec","tag-sports-news","tag-technology","tag-travel","tag-trudeau","tag-us-news","tag-world-news","tag-yukon"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/952674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=952674"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/952674\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/952675"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=952674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=952674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=952674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}