Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data
Canadian law firms' Microsoft 365 environments (help desk vishing campaign)
A voice phishing campaign is breaching Canadian law firms. Callers pose as internal IT support by phone or Microsoft Teams, claim an urgent passkey, MFA or password change, and send staff to firm-branded fake sign-in pages that relay credentials and MFA to the real identity provider in real time. The attackers then register their own MFA devices, delete security notifications, pull data from Microsoft 365 (SharePoint, OneDrive) with scripts and Microsoft Graph, and send extortion demands, according to the Canadian Centre for Cyber Security's Oct 28 2026 alert. The Globe and Mail reports at least four Bay Street firms were compromised: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais (part of its Microsoft cloud environment, including client files) and Bennett Jones (two business services staff accounts on Oct 19; client revenue reports and some mandate descriptions taken, document management and accounting systems not breached).
Why this severity: Confirmed data theft at multiple firms with client information, but nothing for readers to patch; the campaign is ongoing
- Started
- Oct 19, 2026
Affected
- Confirmed breached: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais, Bennett Jones
- Any organization whose staff can be talked into enrolling MFA on an attacker's sign-in page
Fixed in
No fixed release yet
Timeline3
Bennett Jones and Borden Ladner Gervais confirm breaches, joining McCarthy Tétrault and Davies; BLG says part of its Microsoft cloud environment, including client files, was accessed and it hired Mandiant.
The Canadian Centre for Cyber Security publishes AL26-028 on an ongoing help desk vishing campaign against Canadian organizations, with October activity concentrated on the legal sector; it bypasses conventional MFA through real-time relay.
Two Bennett Jones business services employees' accounts are compromised as part of what the firm calls a larger campaign targeting Canadian law firms.
Advisories1
News & write-ups2
Notes & caveats
The Cyber Centre says the tradecraft matches publicly reported operations by a financially motivated actor but doesn't name it. Gowling WLG says it was targeted but found no compromise.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
