Breach Debrief: Four Bay Street Law Firms Were Breached by a Phone Call. The Real Prize Was Their Clients' Secrets.

This is the fourth entry in The Breach Debrief. I take a real, publicly documented cyber incident, walk the chain of events the way an investigator would, and pull out the lessons - some obvious, some not. This one is still unfolding, so everything below reflects public reporting and the Canadian Centre for Cyber Security's alert as of November 1, 2026, and some of it will change. I have no inside information, and I'll separate what is reported, what is claimed, and what nobody knows yet.

Next up: the Bay Street law firm breaches.

What happened

Between about October 19 and 23, attackers compromised employee accounts at several of Canada's largest law firms. At least four firms have confirmed it. McCarthy Tétrault discovered the incident on October 22 and told clients and law enforcement by October 25, describing "a co-ordinated social engineering campaign" in which an unauthorized third party reached certain files, including information relating to clients. Davies Ward Phillips & Vineberg reported a compromise of information from one account. Bennett Jones said two business services employees' accounts were compromised on October 19 as part of a "larger campaign targeting Canadian law firms," and that the stolen information included client revenue reports and, in some cases, general descriptions of client mandates. Borden Ladner Gervais said an unauthorized party accessed a portion of its Microsoft cloud environment, including client-related files.

Other firms were targeted and, by their own accounts, not breached. According to the Globe and Mail, at least seven employees across the firms gave the attackers access. One unnamed source told the paper that about 31,000 files were stolen from McCarthy Tétrault. The firm declined to confirm the number, and I'd treat it as unverified.

All of the breached firms say they've notified law enforcement and are contacting affected clients. McCarthy Tétrault and BLG hired outside incident response firms. No one has publicly identified the attackers.

Why a law firm is the prize

I want to spend real time on this, because it's the part that gets lost when we talk about "a data breach at a law firm."

A law firm is not just a business with data. It is the one place where the most sensitive information from dozens or hundreds of organizations is gathered, because the clients put it there on purpose. They trust counsel with what they would never put on their own public network.

Think about what that includes. Merger and acquisition work: the target's identity, valuation, deal structure, financing, timing and due diligence files, all of it nonpublic until the announcement, and some of it market-moving. Patent work: invention disclosures and draft applications for inventions that are pending, unfiled or unpublished, where early exposure can put patent rights and trade secrets at risk. Litigation: strategy, privileged advice and settlement positions. Regulatory investigations, restructurings and financings. Tax, financial and health records. Board matters and the personal details of executives.

Now put all of that behind a handful of Microsoft 365 accounts. A single compromised employee account can reach the working files of many clients at once. For an attacker, the economics are simple: why breach a hundred companies, each with its own defenses, when you can breach the one firm they all trust?

That's also why the value to criminals is broader than most people assume. Early knowledge of a deal can be traded on or sold. Pending intellectual property is competitive intelligence, and a gift to a nation-state or a rival. Privileged strategy is leverage in a lawsuit. And any of it is a basis for extortion, because the damage from exposure lands on the firm's clients as well as the firm. The Cyber Centre's own description of this campaign includes extortion demands after data theft.

I want to be precise, because precision is the point of these debriefs. I have not seen any report that M&A files or patent applications were taken in these breaches. What's been reported is client revenue reports, general descriptions of client mandates, and client-related files, with the full scope still unknown even to the firms and their clients. My point isn't that the worst has happened. It's that the worst is what these firms hold, and that is exactly why the campaign, according to the Cyber Centre, concentrated on the legal sector in October. Attackers go where the value is.

The chain of events, as far as it's known

Contact: employees get a call, a Teams message or call, or a call from a spoofed help desk number, from someone claiming to be internal IT. The pretext is urgent: a passkey migration, an MFA enrolment, a password change or a software update.

The trap: the caller sends them to a fake sign-in page, on a lookalike domain, that imitates the firm's own enrolment portal. The page relays the employee's password and their MFA response to the real service in real time, so the attacker walks away with a fully authenticated session. That's how the "MFA bypass" works, and why a firm with MFA is not necessarily a protected firm.

Persistence and cleanup: according to the Cyber Centre, the attacker may then register its own authentication method so access survives a password reset, delete the security notification emails, and reset passwords for other applications.

Theft: automated tools using Microsoft Graph search the employee's Microsoft 365 files and pull out data from SharePoint, OneDrive and connected services. The Cyber Centre says extortion demands follow. I want to flag that this is the alert's description of the campaign, not a confirmed account of what happened at each firm.

The attribution question is open. The Globe reports no named group. The Cyber Centre says the tradecraft and infrastructure tie to a financially motivated threat actor and points to Google Cloud research, and that is a statement about the campaign's methods, not a finding about who hit these firms.

What is the access point, really?

There was no software vulnerability here and no malware at the front door. The access point was a person, a phone and a convincing script. In an earlier debrief on the French fridge attack I said an unresolved entry method is itself a finding. This is the opposite case: the method is known, and it's old. It is the help-desk impersonation playbook, the same one reported in the 2025 attacks on Marks & Spencer and the Co-op, with one upgrade. This time the attackers brought the MFA with them.

Lessons, obvious and not

The obvious one: MFA is not a single thing. Codes and push approvals can be relayed by a fake page. The Cyber Centre's guidance is phishing-resistant MFA, meaning hardware security keys or device-bound passkeys, for privileged and high-risk users first, plus conditional access that requires managed devices.

Second, less obvious: an account's reach is the blast radius. Bennett Jones says the compromised accounts were business services accounts and that its document management and accounting systems were not breached. If that holds up, it's segmentation doing its job, the same thing I noted in the MyHeritage debrief. Where one employee's login can reach many clients' files, a single phone call reaches them too. Matter-based access, ethical walls that actually restrict data, and least privilege decide how bad a bad day gets.

Third: an inbound call you did not start is not verification. If someone from "IT" calls you about your credentials, hang up and call the number you already have. The Cyber Centre notes callers may hang up if you try to verify them independently. That, by itself, tells you what you're dealing with.

Fourth: seniority is not safety. Cybersecurity lawyer Brent Arnold told the Globe that senior staff are more likely to skip security training and are often rushed, and that attacks arriving through Teams look legitimate. The people with the most access are often the least patient with process.

Fifth: the signals are detectable. A new MFA method registered by an unfamiliar device, scripted bulk file access, and deleted security notifications are all things a monitored environment can flag, and the Cyber Centre is explicit about preserving identity-provider and Microsoft 365 audit logs.

Sixth, and this one is for clients: your law firm is one of your most sensitive third parties, and you should manage it like one. Ask the questions. Does the firm use phishing-resistant MFA? How is my matter's data segregated from other clients and from the broader firm? How quickly will you tell me if something happens? What do you keep after the matter closes, and when is it returned or destroyed? And reduce your own exposure: use code names for deals, share through controlled deal rooms rather than attachments, give the firm what it needs and no more, and close out old matters.

The takeaway

The technical failure here was small and ordinary: a few employees did what a convincing caller asked. The consequence is not small, because of where those employees sit. When a firm is trusted with the most sensitive material of many organizations, its security is, in effect, theirs. This is concentration risk, and the clients carry it whether or not they ever chose to.

None of this is a criticism of the firms involved. Several say they detected the activity quickly and notified clients and police within days, and the same call could reach any organization with a help desk and a phone. If anything, the firms that speak plainly about what happened are doing their clients a service.

In my work I talk about inherent risk and residual risk. A law firm's inherent risk is very high, by nature of what it holds. What decides the outcome is the residual risk, what remains after the controls actually work, and that depends on small things: whether a call gets verified, whether a login is phishing-resistant, whether one account can reach one client or one hundred. Fix those. And if you're a client, ask your firm to prove it.