{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data · updates",
  "home_page_url": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026",
  "feed_url": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/feed.json",
  "description": "A voice phishing campaign is breaching Canadian law firms. Callers pose as internal IT support by phone or Microsoft Teams, claim an urgent passkey, MFA or password change, and send staff to firm-branded fake sign-in pages that relay credentials and MFA to the real identity provider in real time. The attackers then register their own MFA devices, delete security notifications, pull data from Microsoft 365 (SharePoint, OneDrive) with scripts and Microsoft Graph, and send extortion demands, according to the Canadian Centre for Cyber Security's Oct 28 2026 alert. The Globe and Mail reports at least four Bay Street firms were compromised: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais (part of its Microsoft cloud environment, including client files) and Bennett Jones (two business services staff accounts on Oct 19; client revenue reports and some mandate descriptions taken, document management and accounting systems not breached).",
  "language": "en",
  "_pwn": {
    "slug": "canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-30-13abd171",
      "url": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-30-13abd171",
      "title": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: Bennett Jones and Borden Ladner Gervais confirm breaches, joining McCarthy Tétrault and Davies; BLG says part of its Microsoft cloud environment, including client files, was accessed and it hired Mandiant.",
      "content_text": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: Bennett Jones and Borden Ladner Gervais confirm breaches, joining McCarthy Tétrault and Davies; BLG says part of its Microsoft cloud environment, including client files, was accessed and it hired Mandiant.\n\nSource: https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-28-90ab91ab",
      "url": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-28-90ab91ab",
      "title": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: The Canadian Centre for Cyber Security publishes AL26-028 on an ongoing help desk vishing campaign against Canadian organizations, with October activity concentrated on the legal sector; it bypasses conventional MFA through real-time relay.",
      "content_text": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: The Canadian Centre for Cyber Security publishes AL26-028 on an ongoing help desk vishing campaign against Canadian organizations, with October activity concentrated on the legal sector; it bypasses conventional MFA through real-time relay.\n\nSource: https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-19-151f4b84",
      "url": "https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026#2026-10-19-151f4b84",
      "title": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: Two Bennett Jones business services employees' accounts are compromised as part of what the firm calls a larger campaign targeting Canadian law firms.",
      "content_text": "Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data: Two Bennett Jones business services employees' accounts are compromised as part of what the firm calls a larger campaign targeting Canadian law firms.\n\nSource: https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/",
      "tags": [
        "medium"
      ]
    }
  ]
}