Four Canadian Bay Street law firms breached in vishing campaign impersonating IT support

Four of Canada's largest law firms, McCarthy Tétrault, Borden Ladner Gervais (BLG), Bennett Jones and Davies Ward Phillips & Vineberg, have said they experienced recent data breaches in a coordinated voice phishing campaign in which attackers impersonated internal IT support over Microsoft Teams and spoofed phone calls and steered employees to fraudulent sign-in pages. Canada's Cyber Centre warned last week of an ongoing campaign against legal and financial firms, saying multiple firms were targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages. All four firms said the damage has been contained and that they are alerting affected clients. Prepared as a Cybersecurity item, not a Breaches add: no confirmed total record count has been published across the firms.

BLG confirmed in its own October 30 statement that an unauthorized third party accessed a portion of its Microsoft cloud environment and accessed certain files, including client related files, that it contained the incident shortly after it occurred, and that it engaged Mandiant to investigate. A reported figure of about 31,000 files at McCarthy Tétrault rests on an unnamed source in Globe and Mail reporting and the firm has not confirmed that number, so no file total is stated here; the item will be updated if the firms publish confirmed figures.

Sources: ABA Journal; BLG; Law.com