Bay Street Law Firm Data Breach: 4 Firms Hit [2026] | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Four of Canada’s biggest law firms spent the last two weeks cleaning up after a coordinated voice-phishing campaign. Bennett Jones and Borden Ladner Gervais (BLG) confirmed they were compromised, according to The Globe and Mail, joining McCarthy Tétrault and Davies Ward Phillips & Vineberg in a Bay Street law firm data breach that has put thousands of client files in unknown hands. McCarthy Tétrault alone lost 31,000 files, the Globe reported.What Happened at Bennett Jones and BLGThe Four Confirmed Victims and What Each DisclosedHow the Vishing Attack WorkedImpersonating the IT DepartmentFake Sign-In Pages That Defeat MFAWhat Was Stolen and What Stayed SafeFirm Responses and the Forensic Teams Called InThe Firms That Fended Off the Same AttackWhy Law Firms Make Attractive TargetsRegulators and Disclosure: What Is and Is Not KnownMarket Impact on Canadian Legal and Cybersecurity ServicesHow This Compares With Other Recent Canadian BreachesDefences That Stop VishingWhat Clients of Affected Firms Should Do NowPredictions: Where the Bay Street Fallout Heads NextThe Bigger Lesson for Canadian OrganizationsFrequently Asked QuestionsWhich law firms were hit in the Bay Street data breach?How did the attackers get in?What data was stolen from Bennett Jones?How many files were taken?Who is behind the attack?Who is investigating?What should an organization do to avoid a similar attack?

The attackers did not exploit a software flaw. They called and messaged staff while posing as internal IT, then steered at least seven employees to fake sign-in pages. If you read our earlier coverage of the Crime Stoppers tip leak, the pattern will look familiar: a trusted organization, sensitive data, and a long list of unanswered questions.

This analysis sorts what the Globe has confirmed from what nobody has said publicly. It also looks at why the attack worked, what it signals for Canadian professional-services security, and which controls would have blunted it. Anything beyond the reported facts is labelled as analysis.

Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Happened at Bennett Jones and BLG

Bennett Jones told the Globe that two accounts belonging to business services employees were compromised on October 19. The firm said it detected the activity right away and moved to contain it, investigate it and assess the affected data. That makes Bennett Jones the earliest dated intrusion in the reporting so far.

BLG described a narrower public picture. Chief executive David Di Paolo said an unauthorized third party accessed a portion of the firm’s Microsoft cloud environment, per the Globe. The firm has not said how many users were affected, and the Globe’s reporting lists that number as unclear.
You may like

The two firms sit on opposite sides of a larger story. McCarthy Tétrault was hit on October 22 and Davies on October 23, the Globe reported, so the campaign moved across Bay Street within roughly four days. Counting all four victims, at least seven employees handed access to the attackers.

All four firms notified law enforcement, according to the Globe. The Canadian Centre for Cyber Security also issued a warning about the campaign. Law firm chief information officers have started sharing intelligence and best practices with one another, which is rare for firms that compete hard for the same clients.

The Four Confirmed Victims and What Each Disclosed

The table below pulls together what the Globe and Mail has reported about each firm. Blank answers mean the firm or the reporting has not disclosed the detail. We have not filled any gaps with estimates.

FirmReported dateAccounts compromisedReported data impactForensic firmBennett Jones LLPOctober 192 business services accountsClient revenue reports, general mandate descriptions. Document management and accounting systems not breachedNot named in the Globe reporting we reviewedBorden Ladner Gervais LLPNot specifiedUnclearAccess to a portion of the firm’s Microsoft cloud environmentMandiant (a Google subsidiary)McCarthy Tétrault LLPOctober 224 employee accounts31,000 files stolenCrowdStrikeDavies Ward Phillips & Vineberg LLPOctober 231 employee accountClient-related files, scope not detailedNot named in the Globe reporting we reviewed

The numbers look modest next to a mass-leak event, but they carry a different weight in law. One compromised account can open a folder tree that holds privileged material. Thirty-one thousand files from four accounts at McCarthy Tétrault shows how much a single hurried click can expose.

How the Vishing Attack Worked

Vishing is voice phishing. The Globe described a layered version of it, combining chat, phone calls and counterfeit login pages. Each layer made the next one more believable, which is why trained professionals still fell for it.

Impersonating the IT Department

According to the Globe, the attackers sent Microsoft Teams messages that appeared to come from internal IT employees. They also placed phone calls that spoofed the IT department’s number. A staff member who sees an internal-looking chat and then gets a matching call has little reason to doubt the request.

Law firms make this easier than most employers. Large firms run big support desks, rotate contractors and push frequent IT notices, so an unfamiliar technician’s name seldom raises alarms. Brent Arnold of Capstan Legal told the Globe that attackers exploit the anonymity of working inside a very large organization. He also said they aim at senior people who are always in a hurry.

Fake Sign-In Pages That Defeat MFA

The final step sent victims to fraudulent sign-in pages built to get around multifactor authentication, the Globe reported. This is the detail that matters most to security teams. Standard push approvals and one-time codes can be relayed in real time by a convincing fake portal, so enabling MFA alone did not protect these accounts.

Phishing-resistant methods, such as hardware security keys and passkeys, bind the login to the genuine website and fail on a lookalike. That distinction is explored in our guide to setting up FIDO2 login with a YubiKey, and it applies equally to corporate accounts.

What Was Stolen and What Stayed Safe

Bennett Jones gave the most specific inventory. The stolen data includes client revenue reports and, in some cases, general descriptions of what the firm was doing for those clients. The firm’s document management system, where legal files sit, and its accounting system were not breached.

That is a meaningful line to draw. Document management systems hold the contracts, memos and filings that make up the core of a client file. If those stayed sealed at Bennett Jones, the exposure there is closer to commercial intelligence than to privileged legal work. Even so, a list of who pays a firm how much, and for what kind of mandate, can reveal a pending acquisition or a quiet restructuring.

At the other firms the picture is blurrier. BLG says only that a portion of its Microsoft cloud environment was accessed. McCarthy Tétrault’s 31,000-file figure tells us volume but not content. The Globe also reports that firms have not said whether they are watching for leaked data or have already found any.

Three questions remain unanswered in public reporting:

Who ran the campaign. The Globe says the attackers’ identities are not known.Whether any ransom or extortion demand exists. The reporting does not mention one.Which regulators have been formally notified. The Globe’s coverage does not specify.

Firm Responses and the Forensic Teams Called In

BLG hired Mandiant, the Google-owned incident response firm, to investigate. McCarthy Tétrault brought in CrowdStrike, whose team is based in Austin, Texas, according to the Globe. Both are top-tier names, which signals that the firms treat this as a serious intrusion and not a routine phishing event.

Bennett Jones said it detected the activity quickly and acted to contain it. Speed matters here. In account-takeover cases, the gap between the first malicious login and the first mass download often decides how much leaves the building. The firm has not published a timeline, so outsiders cannot yet judge how fast containment actually was.

Transparency is the stated priority at other firms. Peter Castiel, chair of Stikeman Elliott, told the Globe that the first and most important step is being completely transparent with clients. Stikeman was not compromised, but his comment sets an informal standard the four affected firms will be measured against.

Clients are being contacted, the Globe reports. What they are being told, and how soon, is the part that will shape trust over the next quarter. A firm that tells a client early and plainly usually keeps the relationship. A firm that lets a client learn from a news story rarely does.

The Firms That Fended Off the Same Attack

Not every target fell. Stikeman Elliott and Gowling WLG were both approached, but neither has confirmed a compromise, according to the Globe. Both have engaged outside cybersecurity firms to check their environments.

That detail suggests a campaign aimed at Bay Street as a whole, not at one firm’s weak spot. The attackers appear to have worked down a list of prestige names and kept going until staff at some of them complied. Firms that resisted may have had better call-back procedures, tighter Teams settings or simply luckier timing. The public record does not say which.
You may like

Analysis: the near-misses are valuable evidence for the industry. A shared post-mortem comparing why four firms fell and two held would teach more than any vendor white paper. The CIO information-sharing the Globe describes is the right start, and the firms that stayed clean have the most useful lessons to share.

Why Law Firms Make Attractive Targets

A law firm is a concentrated store of other people’s secrets. It holds merger plans, litigation strategy, tax structures and negotiating positions for corporate clients, and it often holds them before any public announcement. For an attacker, one firm can substitute for dozens of separate intrusions.

The business model compounds the risk. Partners need to reach files from home, from court and from airports, so firms keep remote access wide open. Their core product is trust, which makes any admission of loss expensive. Attackers who understand this can lean on the reputational cost, whether or not they ever make a formal demand.

Professional rules add another layer. Lawyers owe clients a duty of confidentiality, and law societies regulate how that duty is met. A breach of client information can therefore trigger conversations with regulators and insurers as well as with the clients themselves. The Globe’s reporting does not detail any law society action so far.

The same dynamic showed up in the DHS employee records leak, where a large set of staff records ended up exposed. Analysis: identity and cloud accounts are now a main battleground, and Microsoft 365 tenants hold much of the data professional-services firms care about.

Regulators and Disclosure: What Is and Is Not Known

The Canadian Centre for Cyber Security issued a warning about the campaign, the Globe reports. Beyond that, the reporting does not describe any formal notification to the Office of the Privacy Commissioner or to provincial law societies, and we will not assume one.

Under Canada’s federal private-sector privacy law, organizations must report breaches that create a real risk of significant harm to affected individuals. Whether client revenue summaries or mandate descriptions meet that threshold depends on what they contain and who they identify. Firms will weigh that question with outside counsel, who in this case are themselves the victims.

The Privacy Commissioner’s office has been busy with similar disclosures lately. Our coverage of the Navigate360 PIPEDA investigation shows how the regulator approaches a breach once it opens a file. A law firm case would raise extra complications because solicitor-client privilege can restrict what investigators may see.

Market Impact on Canadian Legal and Cybersecurity Services

No stock-price or revenue figures have been reported for any of the firms, which are all private partnerships. The impact will show up elsewhere. Analysis: expect general counsel at large Canadian corporations to send security questionnaires to their outside firms within weeks, and expect those questionnaires to ask specifically about help-desk verification and phishing-resistant MFA.

Incident response providers stand to gain. Mandiant and CrowdStrike are already engaged on two of the four cases. Mid-size firms that watched this unfold are likely to commission tabletop exercises and vishing simulations before year-end. Cyber insurers will probably tighten underwriting questions for professional-services clients, though no carrier has said so publicly.

Microsoft is a quieter participant. The attacks abused Teams and Microsoft sign-in flows, but the Globe does not report any flaw in the products themselves. The weaknesses came from configuration and human trust. Still, administrators will review whether their tenants allow outside parties to message staff on Teams, a setting that turned out to carry real risk.
Read nextLethbridge Pauses Crime Stoppers, Calgary Stays: 1.5M [2026]Cybersecurity · 18 h ago

How This Compares With Other Recent Canadian Breaches

Canada has absorbed a steady run of breach stories this year. The table compares the Bay Street campaign with three recent ones covered on this site. Only characteristics reported in our earlier articles or the Globe are listed.

IncidentVictim typeEntry pointScale reportedMain concernBay Street law firm breach4 large law firmsVishing via Teams and phone, fake sign-in pagesAt least 7 employees, 31,000 files at McCarthy TétraultClient confidentialityCrime Stoppers tip leakTip-line operatorsSee our earlier report1.5M tipsInformant safetyDHS employee data leakUS government agencySee our earlier report40,000 staff recordsStaff exposureNavigate360 caseSafety-software vendorSee our earlier report1.5M tipsPrivacy law compliance

The Bay Street case stands apart because of its human entry point. The others involved platforms and vendors. Here, nobody needed to break a system, because employees opened the door when they thought IT was asking them to.

Defences That Stop Vishing

Security teams can make this attack far harder without exotic tools. The controls below are standard practice and map directly onto the steps the Globe describes. None is guaranteed to stop a determined caller, but together they remove the easy wins.

Attack stepControl that blunts itEffortTeams message from fake ITBlock or restrict external Teams chats, label outside sendersLowSpoofed IT phone numberStaff rule: IT never asks for sign-in over an inbound callLowFake sign-in pagePasskeys or hardware security keys that refuse lookalike sitesMediumRelayed MFA approvalNumber matching and conditional access tied to managed devicesMediumRapid file downloadAlerts on unusual bulk access from new locationsMediumHurried senior staffShort, role-specific vishing drills for partners and executivesLow

Device-level checks add a second wall. If sign-ins only work from managed, compliant laptops, a stolen credential on an attacker’s machine goes nowhere. Our walkthrough of 1Password Device Trust shows one way to enforce that, and the same principle holds in Microsoft’s own conditional access tools.

Individual staff can also help themselves. Browser-based password managers refuse to autofill on a domain they do not recognize, which gives users a free warning when a page is fake. Our guide to 1Password phishing protection covers how that check works in practice.

What Clients of Affected Firms Should Do Now

If your company uses Bennett Jones, BLG, McCarthy Tétrault or Davies, start by asking your relationship partner two direct questions. Was any of our information in the accessed files? And what has the firm’s forensic team concluded so far? Firms should be ready to answer both, and the Globe reports they are already contacting clients.

Next, treat any recent unusual email or call that references your matters as suspect. Attackers who hold mandate descriptions can write very convincing follow-up messages. Verify payment instructions and document requests through a known phone number before acting on them.

Finally, review what you share with outside counsel. Many companies send entire data rooms when a narrower set would do. Limiting what leaves your environment reduces the damage from any single vendor compromise, whether that vendor is a law firm, an accountant or a software provider.

Predictions: Where the Bay Street Fallout Heads Next

These are analyst-style judgments from us, not reported facts. Each rests on how past breach cases have tended to unfold, and any of them could miss.

More firms will confirm incidents. Stikeman Elliott and Gowling WLG report no compromise today, but outside reviews are underway. Smaller firms that were never in the news cycle may disclose too.Extortion may surface. The reporting mentions no demand, yet stolen client files have obvious resale and pressure value. A leak-site posting or a private demand would change the story quickly.Clients will demand security attestations. Expect corporate legal departments to write phishing-resistant MFA and help-desk verification into engagement terms.Teams hardening becomes routine. Restricting outside Teams contact will move from a niche setting to a baseline for professional-services tenants.A regulator or law society will issue guidance. Given the Canadian Centre for Cyber Security warning, a sector-specific advisory on vishing looks likely within months.

The Bigger Lesson for Canadian Organizations

The Bay Street campaign shows that MFA is a starting line. Firms with deep security budgets and top-tier incident response partners still lost files because a convincing voice and a plausible chat window outweighed training. The fix is partly technical and partly procedural, and the procedural half is cheaper.

Make verification boring and universal. If every employee knows IT will never ask for credentials by call or chat, then any such request is wrong by definition. Pair that rule with sign-in methods that cannot be tricked by a fake page, and the attacker’s best script stops working.

For more reporting on breaches, identity attacks and defences, browse our cybersecurity coverage. We will update this article as the Globe and the affected firms release more detail on the scope of the stolen files.

Frequently Asked Questions

Which law firms were hit in the Bay Street data breach?

The Globe and Mail reports that Bennett Jones, Borden Ladner Gervais, McCarthy Tétrault and Davies Ward Phillips & Vineberg were compromised. Stikeman Elliott and Gowling WLG were targeted, but neither has confirmed a compromise.

How did the attackers get in?

They used vishing, impersonating internal IT staff over Microsoft Teams and spoofed phone calls. Victims were sent to fake sign-in pages designed to get around multifactor authentication, according to the Globe.

What data was stolen from Bennett Jones?

Bennett Jones said the stolen information includes client revenue reports and, in some cases, general descriptions of its mandates for clients. Its document management system and accounting system were not breached.

How many files were taken?

The Globe reports 31,000 files stolen from McCarthy Tétrault. Totals for Bennett Jones, BLG and Davies have not been reported. At least seven employees across the four firms were compromised.

Who is behind the attack?

The Globe says the hackers’ identities are not known, and it reports no ransom or extortion demand. We will not name a group until a credible source does.

Who is investigating?

All four firms notified law enforcement. BLG hired Mandiant and McCarthy Tétrault hired CrowdStrike. The Canadian Centre for Cyber Security issued a warning about the campaign.

What should an organization do to avoid a similar attack?

Adopt phishing-resistant sign-in such as passkeys or hardware keys, restrict outside contact on Teams, and set a firm rule that IT never asks for credentials by inbound call or chat. Run short vishing drills for senior staff, who are frequent targets.More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending now1Password 2FA Setup: 12 Steps, 60 Min [2026]1Password SDK for Node.js: 13 Steps, 75 Min [2026]Migrate LastPass to 1Password: 13 Steps, 75 Min [2026]Oracle Adds Google TPUs, 4 Rival AI Chips to OCI [2026]C$1.6B Cohere, RBC AI Agent Block, Stelco Recall [2026]
Liam CarteriGaming EditorLiam Carter is an iGaming Editor at Tech Insider, previously a Student Researcher at the SDSU Cybersecurity Center, where he developed Python-based ETL pipelines and conducted statistical analysis of large-scale server log datasets. At Tech Insider, he covers casino gaming, sports betting, and digital payments, with a focus on the Canadian and Canadian online gambling markets. He is a certified AWS Cloud Practitioner and has spoken at ICE North America as an editorial representative for iGaming Business.View all articles

——————————————————-
Click Here For The Original Source.

Related