Four of Canada’s Biggest Law Firms Hit in Voice-Phishing Breach Campaign, Reports Say

Four of Canada's largest law firms have confirmed data breaches after a coordinated voice-phishing campaign, according to reports published on November 2, 2026. The firms named are McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies Ward Phillips and Vineberg. Each firm has said the damage has been contained and that affected clients are being notified, and the firms have brought in outside cybersecurity specialists to investigate.

The entry point was not a complex software flaw. According to reports, the attackers talked their way in, posing as IT staff and steering employees toward fake sign-in pages.

What reports say happened

The American Bar Association journal reported on November 2, 2026 that the four firms had experienced recent breaches, citing a report by Law.com. The same coverage pointed to a warning issued last week by the Canadian Centre for Cyber Security about an ongoing phishing campaign aimed at organizations in the legal and financial sectors. The centre said, in the warning quoted in that coverage, that multiple Canadian firms had been targeted by people impersonating internal IT support and directing employees to fraudulent sign-in pages.

Other summaries of the Globe and Mail reporting add timing and scale. McCarthy Tétrault was reportedly hit on October 22, 2026, and Davies was reportedly hit the next day. At least seven employees across the four firms reportedly gave the attackers access. McCarthy Tétrault reportedly had four accounts compromised, Bennett Jones reportedly had two, and Davies reportedly had one. Those figures come from reports rather than a single public statement from all four firms, so they should be read as reported totals.

One figure that has drawn attention is the reported theft of 31,000 files from McCarthy Tétrault alone, attributed in summaries to a source speaking to the Globe and Mail. The firm has reportedly called in CrowdStrike, while Borden Ladner Gervais has reportedly brought in Mandiant. Who carried out the campaign remains unclear in the reporting so far, and no group has been publicly identified as responsible.

How the vishing calls reportedly worked

Voice phishing, often shortened to vishing, relies on trust and urgency rather than malware. In this campaign, the callers reportedly posed as IT staff and warned about critical software updates or expired passwords. Some calls reportedly came through Microsoft Teams, while others appeared to come from the IT department's own number.

Once an employee engaged, the reports say the next step was a fraudulent sign-in page. A page like that can look close enough to a real company login to pass a quick glance, especially when the employee believes IT is waiting on the other end of the call. Entering credentials there can hand an attacker a working username and password. That is why security teams repeat a simple rule: IT will not ask you to sign in through a link sent during an unexpected call.

What each firm has reportedly disclosed

The firms have not published identical statements, and the public record so far is a patchwork of confirmations and reported details. Bennett Jones has reportedly said that client revenue reports and some descriptions of client mandates were taken, but that its document management and accounting systems were not touched. Borden Ladner Gervais has reportedly said that files related to clients were accessed. McCarthy Tétrault has reportedly been linked to the largest file count in the reports, at 31,000 files.

All four firms have reportedly said the damage has been contained and that affected clients are being alerted. Details such as which files were taken often come later, after forensic teams finish reviewing logs.

Why law firms are a high value target

Law firms hold a mix of information that is hard to find in one place anywhere else. Client files can include deal terms, litigation strategy, intellectual property, personal details, and financial records. A single compromised mailbox or document store can therefore give an attacker material for extortion, for sale, or for use in later fraud. Firms also work under tight deadlines, which can make staff more likely to act quickly when a caller claims a system will lock them out.

The Canadian Centre for Cyber Security warning also points to a wider pattern. Legal and financial firms are being targeted together, which suggests the attackers see professional services as a route to valuable data and to clients with money at stake. The warning is also a signal to smaller firms, which may have no formal verification step at all.

What firms and clients should do now

For firms, the immediate fix is a verification rule that is easy to follow under pressure. No employee should approve a password reset, a sign-in, or a remote access request based only on a call or a Teams message, even if the caller sounds internal. A second channel, such as calling back on a known internal number, breaks the attacker's script. Firms should also review sign-in logs for the affected period and force password resets where needed.

For clients of the affected firms, the practical step is to wait for direct notice and to treat any follow-up message about the breach with care. Attackers sometimes reuse breach news for a second wave of phishing, sending fake alerts that ask victims to click a link or confirm details. A genuine notice from a firm should not ask a client to sign in through an unexpected link. When in doubt, contact the firm through a number or address already on file.

Frequently Asked Questions

Which Canadian law firms were hit in this breach campaign?

According to reports published on November 2, 2026, the four firms are McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies Ward Phillips and Vineberg. Each firm has said the damage has been contained and that affected clients are being notified.

How did the attackers reportedly get in?

Reports say the attackers used voice phishing, posing as internal IT staff over phone calls and Microsoft Teams messages. They reportedly warned about software updates or expired passwords and directed employees to fraudulent sign-in pages, where credentials could be captured.

What data was reportedly taken?

The reported details differ by firm. McCarthy Tétrault was reportedly linked to 31,000 stolen files. Bennett Jones reportedly said client revenue reports and some descriptions of client mandates were taken, while its document management and accounting systems were not touched. Borden Ladner Gervais reportedly said files related to clients were accessed. The identity of the attackers has not been publicly confirmed in the reporting so far.