Callers posing as IT got into at least four Canadian law firms, including McCarthy Tétrault and BLG

Over the past two weeks, several of Canada’s largest law firms have said someone got into their systems and took files. The firms named so far are McCarthy Tétrault, Borden Ladner Gervais (BLG), Davies Ward Phillips & Vineberg and Bennett Jones. In each case the way in appears to have been the same: a phone call from someone pretending to be the firm’s IT help desk. If you’re a client of one of these firms, here’s what they’ve said and what you can do.

What happened

McCarthy Tétrault said on October 29 that late on October 22 it identified a “coordinated social engineering campaign” that gave an unauthorized third party access to certain files, including client information. It says it found no evidence of other affected accounts, of the intruder moving deeper into its systems, or of any ongoing access. It contacted affected parties on October 25 and notified law enforcement and regulators.

BLG says there was limited unauthorized access to part of its Microsoft cloud environment, as part of a wider campaign aimed at Canadian law firms, and that certain files, including client files, were accessed. It says the incident was contained shortly after it happened. It brought in Mandiant to investigate, is contacting affected clients directly, and has notified regulators and law enforcement.

According to The Globe and Mail, Davies was hit on October 23 and described it as the compromise of information from one account. A source told The Globe that about 31,000 files were taken from McCarthy Tétrault; the firm declined to comment on the number. Osler, Goodmans, Fasken and Blakes told The Globe they weren’t affected. The Globe later reported that two Bennett Jones business-services accounts were compromised on October 19 and that revenue reports and some descriptions of client mandates were taken, while its document management and accounting systems weren’t breached. Stikeman Elliott and Gowling WLG were targeted but not breached, it reported.

How the calls worked

On October 28, the Canadian Centre for Cyber Security published an alert about an ongoing campaign of fake help-desk calls aimed at Canadian organizations. The caller poses as IT support and says the employee needs to change a password, a passkey or their multi-factor sign-in. They then send the employee to a sign-in page branded with the organization’s name that passes everything, including the one-time code, straight to the real service. The Cyber Centre says the campaign moved toward finance and legal organizations from July and focused on law firms in October.

The Globe reported on October 30 that the calls came through Microsoft Teams or appeared to come from the firm’s own IT number, and that at least seven employees gave access: four at McCarthy Tétrault, two at Bennett Jones and one at Davies. McCarthy Tétrault has hired CrowdStrike, it reported. It’s the same pattern behind many of this year’s large breaches, which we covered in the phone call behind 2026’s biggest breaches.

What this means for you

What was in the taken files will differ from client to client, and the firms haven’t said publicly how many clients are involved. Law firm files can hold contracts, financial details, identity documents and private correspondence. The most likely misuse is targeted: a message that knows the name of your matter, your lawyer or a recent deal, used to push a fake invoice or a change in payment details.

What you can do

1. Wait for your firm to contact you, and check that it’s really them. McCarthy Tétrault says it has already reached affected parties, and BLG says it is contacting affected clients directly and suggests clients with questions talk to their BLG relationship partner. If you get a message about the breach, call your lawyer on a number you already have rather than one in the message.
2. Confirm any change in payment instructions by phone. Be especially careful with trust account transfers, closing funds and invoices that arrive with new bank details.
3. Watch for messages that mention your file. Knowing a detail about your matter doesn’t prove a sender is your firm.
4. If you run IT for an organization, follow the Cyber Centre’s advice: use phishing-resistant sign-in such as passkeys or security keys, and have staff verify any call from “IT” through a separate channel before changing anything.
5. Learn the patterns. See how scammers use leaked data.

How Frame helps

Frame can’t tell you what was in a law firm’s files, but it helps limit what a targeted scam can build on. It watches for your details on data-broker sites and in known breaches, and its email aliases keep your main inbox out of the next leak. Frame never collects or stores the leaked records themselves.

Sources

• McCarthy Tétrault, Statement from McCarthy Tétrault, October 29, 2026
• Borden Ladner Gervais, BLG Statement Regarding Cybersecurity Incident, October 30, 2026
• Canadian Centre for Cyber Security, AL26-028: Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations, October 28, 2026
• The Globe and Mail, Corporate law firms McCarthy Tétrault and Davies hit by data breaches, October 29, 2026
• The Globe and Mail, Bennett Jones, Borden Ladner Gervais hit in data breach targeting Bay Street law firms, October 30, 2026
• The Globe and Mail, How hackers broke into four of Canada’s top law firms, stole client files and caused chaos, October 30, 2026