# Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data · pwn.watch > A voice phishing campaign is breaching Canadian law firms. Callers pose as internal IT support by phone or Microsoft Teams, claim an urgent passkey, MFA or password change, and send staff to firm-branded fake sign-in pages that relay credentials and MFA to the real identity provider in real time. The attackers then register their own MFA devices, delete security notifications, pull data from Microsoft 365 (SharePoint, OneDrive) with scripts and Microsoft Graph, and send extortion demands, according to the Canadian Centre for Cyber Security's Oct 28 2026 alert. The Globe and Mail reports at least four Bay Street firms were compromised: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais (part of its Microsoft cloud environment, including client files) and Bennett Jones (two business services staff accounts on Oct 19; client revenue reports and some mandate descriptions taken, document management and accounting systems not breached). Page: https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026 · generated 2026-10-30T22:14:28.838Z ## Status - Severity: medium · status: live · patch: partial - Product: Canadian law firms' Microsoft 365 environments (help desk vishing campaign) - Started: 2026-10-19 - Affected: Confirmed breached: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais, Bennett Jones; Any organization whose staff can be talked into enrolling MFA on an attacker's sign-in page ## Follow this incident - RSS (one item per update): https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026.json - This file: https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: Bennett Jones and Borden Ladner Gervais confirm breaches, joining McCarthy Tétrault and Davies; BLG says part of its Microsoft cloud environment, including client files, was accessed and it hired Mandiant. (https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/) - 2026-10-28: The Canadian Centre for Cyber Security publishes AL26-028 on an ongoing help desk vishing campaign against Canadian organizations, with October activity concentrated on the legal sector; it bypasses conventional MFA through real-time relay. (https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations) - 2026-10-19: Two Bennett Jones business services employees' accounts are compromised as part of what the firm calls a larger campaign targeting Canadian law firms. (https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/) ## Fix brief # Security brief: Fake IT help desk calls breach at least four Bay Street law firms' Microsoft 365 data Source: https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026 · status: live · severity: medium · updated Oct 30, 2026 ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is A voice phishing campaign is breaching Canadian law firms. Callers pose as internal IT support by phone or Microsoft Teams, claim an urgent passkey, MFA or password change, and send staff to firm-branded fake sign-in pages that relay credentials and MFA to the real identity provider in real time. The attackers then register their own MFA devices, delete security notifications, pull data from Microsoft 365 (SharePoint, OneDrive) with scripts and Microsoft Graph, and send extortion demands, according to the Canadian Centre for Cyber Security's Oct 28 2026 alert. The Globe and Mail reports at least four Bay Street firms were compromised: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais (part of its Microsoft cloud environment, including client files) and Bennett Jones (two business services staff accounts on Oct 19; client revenue reports and some mandate descriptions taken, document management and accounting systems not breached). Severity detail: Confirmed data theft at multiple firms with client information, but nothing for readers to patch; the campaign is ongoing - Product: Canadian law firms' Microsoft 365 environments (help desk vishing campaign) ## Affected versions - Confirmed breached: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Borden Ladner Gervais, Bennett Jones - Any organization whose staff can be talked into enrolling MFA on an attacker's sign-in page ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run Microsoft 365 for a firm: move high-risk users to phishing-resistant MFA (FIDO2 keys or device-bound passkeys), require managed devices in conditional access, tighten verification for MFA resets and new device enrolments, restrict external Teams chats, and alert on new MFA registrations, deleted security emails and bulk Graph file access. Tell staff to hang up on unexpected IT calls asking for MFA or passkey changes and call IT back on a known number. ## Latest updates - Oct 30, 2026: Bennett Jones and Borden Ladner Gervais confirm breaches, joining McCarthy Tétrault and Davies; BLG says part of its Microsoft cloud environment, including client files, was accessed and it hired Mandiant. - Oct 28, 2026: The Canadian Centre for Cyber Security publishes AL26-028 on an ongoing help desk vishing campaign against Canadian organizations, with October activity concentrated on the legal sector; it bypasses conventional MFA through real-time relay. - Oct 19, 2026: Two Bennett Jones business services employees' accounts are compromised as part of what the firm calls a larger campaign targeting Canadian law firms. ## Advisories - [AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations](https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations) (Canadian Centre for Cyber Security) ## Write-ups & news - [Bennett Jones, Borden Ladner Gervais hit in data breach targeting Bay Street law firms](https://www.theglobeandmail.com/business/article-bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/) - [Fraud Alert: RCMP Identifies Cyber Threat Targeting Canadian Law Firms](https://nsbs.org/society-news/fraud-alert-rcmp-identifies-cyber-threat-targeting-canadian-law-firms/) ## Caveats The Cyber Centre says the tradecraft matches publicly reported operations by a financially motivated actor but doesn't name it. Gowling WLG says it was targeted but found no compromise. --- Machine-readable: https://pwn.watch/i/canadian-law-firms-help-desk-vishing-m365-breaches-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.