The October 2026 Canadian law firm cyberattacks named four major firms: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais (BLG) and Bennett Jones. Public information confirms unauthorized access and client-related information at some firms, but it does not establish one attacker, one entry method or the same impact across all four.
The incidents arrived alongside a federal warning about an active help-desk voice-phishing campaign targeting Canadian organizations. The Canadian Centre for Cyber Security alert AL26-028 describes callers posing as internal IT support, fraudulent sign-in pages that relay credentials and multi-factor authentication responses in real time, and post-compromise access to Microsoft 365 and connected software-as-a-service data.
The clearest answer is also the most careful one: the four law firm cyber incidents and the government-confirmed vishing campaign overlap in timing and sector, but the public evidence does not prove that every firm was compromised in the same way. For law firms and their clients, the useful questions are what happened, how a vishing attack can bypass ordinary MFA and what a coordinated response needs to cover.
What happened in the Canadian law firm cyberattacks?
October 19: Reporting published on October 31 said Bennett Jones identified compromise involving two business-services accounts. The same reporting said the firm’s document management and accounting systems were not affected, while some client revenue reports and mandate descriptions were involved.
October 22: McCarthy Tétrault detected an intrusion, according to the same dated reporting. The firm reportedly said an unauthorized third party accessed certain files, including client-related information, and that it engaged an external cybersecurity firm. A file count circulated from an unnamed source, but has not been included here because the firm did not publicly confirm it.
October 23: Davies Ward Phillips & Vineberg reportedly identified a cyberattack involving information from one account. Public reporting did not provide enough primary detail to establish the complete scope or technical entry path.
Late October: In its public statement, BLG confirmed limited unauthorized access to part of its Microsoft cloud environment. It said certain files, including client-related files, were accessed. BLG also said its controls contained the incident shortly after it occurred, Mandiant was engaged to investigate and support remediation, and affected clients were being contacted.
October 28: The Cyber Centre issued AL26-028. It warned of an active vishing campaign targeting Canadian organizations, including legal and financial organizations, and said October activity was concentrated on the legal sector.
October 31: Reporting brought the four firms together as part of a wider series of law-firm incidents. That chronology is useful, but it does not replace firm-specific technical findings.
The evidence is uneven. BLG’s statement is a direct primary source. Current details about McCarthy Tétrault, Davies and Bennett Jones come from statements attributed to those firms in dated reporting. The Cyber Centre alert independently confirms an active Canadian campaign and its methods, but does not state that all four firms were compromised in the same way.
What did each law firm confirm?
McCarthy Tétrault: Current reporting says the firm detected unauthorized access on October 22 and found that certain files, including client-related information, had been accessed. It reportedly engaged an outside cybersecurity firm and contacted affected clients. The public record does not establish an exact confirmed file count, actor or entry method.
Davies Ward Phillips & Vineberg: Davies was reported to have identified compromise involving information from one account. One compromised account can still expose significant information, but the wording does not support assumptions about more accounts, identical data theft or the same technical path used elsewhere.
Bennett Jones: Reporting said two business-services accounts were compromised. It also said the firm’s document management and accounting systems were not affected, while some client revenue reports and mandate descriptions were involved. That differs from BLG’s Microsoft cloud disclosure and should not be turned into a common claim about systems or client impact.
Borden Ladner Gervais: BLG confirmed limited unauthorized access to part of its Microsoft cloud environment and access to certain files, including client-related files. It said the incident was contained shortly after it occurred, its investigation remained ongoing, and relevant professional regulators and law enforcement had been notified. BLG described the event as part of a wider campaign targeting Canadian law firms, but that does not prove one actor or one compromise path across all four.
How can a help-desk vishing attack bypass MFA?
A help-desk vishing attack uses a trusted support interaction to move an employee into a fraudulent identity flow. The attacker does not necessarily need to break MFA. Instead, the attacker persuades the employee to complete a legitimate-looking authentication challenge for a session the attacker controls.
The caller impersonates internal IT or the help desk, often using an urgent passkey migration, MFA enrolment or password change as the pretext. Contact can arrive through a personal phone, office phone or Microsoft Teams. The caller may know internal names or spoof a familiar number.
The employee is then directed to an organization-branded sign-in page on a deceptive domain. That page sits between the employee and the legitimate identity provider. When the employee enters a password and responds to an MFA prompt, the page relays both in real time. The attacker obtains an authenticated session, not just a password.
The Cyber Centre says reported post-compromise activity can include registering attacker-controlled MFA methods or devices, deleting security notifications, resetting passwords for non-single-sign-on applications, and using scripts and Microsoft Graph to access data in Microsoft 365 and connected SaaS applications such as SharePoint and OneDrive. Data theft may be followed by extortion.
“Microsoft Teams vishing” should not be read as a flaw in Teams itself. The collaboration tool provides a trusted setting. The attacker borrows that trust and moves the employee into a fraudulent identity flow. Microsoft documented a separate 2025 case in which a Teams support call led to compromise. It reinforces the wider identity-first risk, but does not prove the same steps occurred at each Canadian firm.
What remains unknown?
The public record does not yet establish:
- Whether one threat actor was responsible for all four incidents
- Whether each firm was reached through vishing, Teams or another entry method
- Whether the same identity platform, application or account type was involved
- How many files were accessed or removed at each firm
- Whether the information had the same sensitivity or client impact
- Whether persistence or extortion occurred in every case
These questions affect notification duties, client exposure, containment priorities and attribution. When investigations are active, “not publicly confirmed” is often the most accurate answer available.
Why does law firm cybersecurity matter to clients?
Law firms collect information that clients may not hold together anywhere else. A legal matter can include contracts, transaction plans, financing details, employment records, litigation strategy, personal information and privileged communications. Deal and dispute files can also reveal timelines, decision-makers and pressure points.
This creates shared-data risk. A client’s own network can remain untouched while sensitive information held by outside counsel is exposed. The same principle applies to accountants, benefits providers, consultants and other professional advisers.
Law firm cybersecurity is therefore part of a client’s information-risk picture, not simply the law firm’s internal technology concern. Organizations need to understand which advisers hold high-consequence information, how incident notices will be assessed and how legal, IT, privacy, communications and executive teams will coordinate if that information is exposed.
Why is a managed response more than a checklist?
The Cyber Centre’s recommendations cover identity, devices, monitoring, containment and decision-making. Those controls depend on one another. A business can deploy MFA and still remain exposed if enrolment can be socially engineered, sessions are not revoked after compromise or unusual Microsoft 365 activity is not connected to identity alerts.
Phishing-resistant authentication, including FIDO2 security keys, device-bound passkeys and supported platform authenticators, can reduce reliance on sign-in flows that fraudulent pages can relay. The protection still depends on sound enrolment, recovery and support processes. ThinkSwift’s guide to passkeys for businesses explains those tradeoffs.
Conditional access can limit what an authenticated session may reach from an unmanaged device, commercial VPN, hosting provider or residential proxy. Monitoring needs to connect new MFA methods, deleted security notices, password resets and unusual SharePoint, OneDrive or Microsoft Graph activity. If compromise is suspected, containment may require revoking sessions and tokens, removing unauthorized MFA methods or devices, reviewing mailbox and file activity, and preserving the logs needed to establish what happened.
The technical work also needs clear ownership. Identity teams, Microsoft 365 administrators, legal and privacy advisers, communications leaders and executives may all have decisions to make. A managed response coordinates those decisions with the evidence, so urgent action does not destroy useful logs, leave active sessions behind or create conflicting messages for affected clients.
ThinkSwift’s Cyber360 overview describes a broader approach to prevention, monitoring and response.
Talk to us about the risk behind the headlines
Organizations do not need to wait for every detail of the four incidents to be resolved. The supportable lesson is already clear: a convincing IT impersonation can turn a legitimate MFA response into cloud access, and sensitive information may sit with advisers outside the client’s own network.
This is not a problem that a generic checklist can resolve. The controls, Microsoft 365 signals, response ownership and third-party information risks need to work together in the environment the organization actually uses.
If your organization relies on Microsoft 365 or shares sensitive information with law firms and other professional advisers, get in touch with ThinkSwift. We can talk through the exposure and the managed cybersecurity response needed to address it.
Get in touch