A quiet, almost ordinary-sounding phone call has become a doorway into some of Canada's most trusted rooms. Over a single week in late October, hackers posing as the IT staff of four leading law firms persuaded lawyers to surrender the keys to their systems, and in doing so exposed the private affairs of the clients who had placed their confidence in them. The episode reveals something older than any software: that trust, once it is the only lock on a door, can be lifted by a patient voice. What happens next depends less on the machines than on whether the people who were trusted choose to spe
Vishing Attack Breaches Four of Canada's Top Law Firms, Exposing Client Files and Sensitive Data
Clients' tax, financial and health records and confidential legal communications may have been exposed, with affected clients still awaiting details.
It sounds boring enough that it's probably real.
Mark
Why does this one stand out from other breaches?
Mimi
Because of who was hit. Four of the country's most prestigious firms, and the files hold client tax, financial and health records plus privileged communications.
Mark
And the method was just phone calls?
Mimi
Calls and Teams messages posing as internal IT. Seven employees at least gave access, and the fake sign-in pages got around multifactor authentication.
Luke
Let's separate what's solid. Which numbers are confirmed?
Mimi
The seven employees are confirmed by the firms. The 31,000 files at McCarthy Tétrault comes from one source directly involved, not from the firm.
Luke
So that's one person's figure. What else is unknown?
Mimi
Who the hackers are, what they're doing with the data, and whether the firms have found any of it leaked. That's from one source, and for some cases only. BLG's count of compromised users is unclear too.
Mark
Why would busy senior lawyers be the targets?
Mimi
Arnold says they skip training and are always in a hurry, so they question less.
Luke
That's an expert's view of why it works, not a finding about these specific employees.
Mark
What should clients expect?
Mimi
Direct contact as firms identify them. Bennett Jones says it will do that, and Castiel says transparency comes first.
Il Polso
- Calls that sounded like their own IT department reached lawyers at four major firms, and many arrived through Microsoft Teams with an unsettling air of normalcy.
- Seven employees followed instructions into fraudulent sign-in pages, and the multifactor protections meant to stop intruders were quietly walked around.
- McCarthy Tétrault reportedly lost 31,000 files, and clients holding tax, financial and health records are still waiting to learn whether their own information was taken.
- Firms are pooling intelligence and hiring outside investigators like CrowdStrike and Mandiant, but the hackers' identities and their plans for the stolen data remain unknown.
- The true measure of the response is still ahead, as clients await the transparency that the firms say is their first and most important duty.
A quiet, almost ordinary-sounding phone call has become a doorway into some of Canada's most trusted rooms. Over a single week in late October, hackers posing as the IT staff of four leading law firms persuaded lawyers to surrender the keys to their systems, and in doing so exposed the private affairs of the clients who had placed their confidence in them. The episode reveals something older than any software: that trust, once it is the only lock on a door, can be lifted by a patient voice. What happens next depends less on the machines than on whether the people who were trusted choose to speak plainly to those who trusted them.
About a week ago, lawyers at some of Canada's most prestigious firms began receiving urgent calls from what seemed to be their own IT departments. The callers spoke of a critical software update or an expired password, and they were patient, willing to stay on the line and walk each person through the fix. Many of the calls came through Microsoft Teams and looked entirely internal. The people on the other end were criminals, and the technique, known as vishing or voice phishing, worked.
At least four firms were breached: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais. Seven employees across them gave the hackers access by entering credentials on fraudulent sign-in pages that got past multifactor authentication. McCarthy Tétrault reportedly lost 31,000 files. The damage is still being measured, and clients are often waiting for word on whether their information was touched.
The stakes are high because law firms hold what clients tell them in confidence, including tax, financial and health records. Bennett Jones said its core document system was untouched but that revenue reports and some mandate descriptions were exposed. BLG, Davies and McCarthy Tétrault described varying degrees of access to client-related files. Each firm's account differs in scope, and much remains unclear.
Experts say the attacks exploit the anonymity of large organizations, where colleagues are unfamiliar and senior staff are busy and less likely to have completed security training. The firms are now sharing intelligence and bringing in outside investigators, including CrowdStrike and Mandiant. Stikeman Elliott, which was targeted but not breached, has urged its lawyers to tell clients the whole truth. What clients hear in the coming days will show whether that promise holds.
About a week ago, lawyers at some of Canada's most prestigious firms got urgent calls from what appeared to be their own IT departments. The callers said a critical software update was needed, or that a password had expired. They were patient and happy to stay on the line and walk people through the fix. Many of the calls came through Microsoft Teams and looked internal. Others came from the IT department's own number.
The people on the other end were hackers, calling lawyers en masse. The tactic is known as vishing, short for voice phishing, in which criminals use phone calls or voice messages to trick people into handing over access or information. It worked. At least four firms were broken into: McCarthy Tétrault LLP, Davies Ward Phillips & Vineberg LLP, Bennett Jones LLP and Borden Ladner Gervais LLP. McCarthy Tétrault was hacked on Oct. 22 and Davies on Oct. 23.
The full damage is still being assessed. Law firms sell themselves as trusted advisers, and their servers hold non-public corporate information, communications between clients and counsel, and clients' tax, financial and health records. At McCarthy Tétrault, 31,000 files were stolen, according to a source directly involved. Lawyers at the affected firms have been told which clients were touched, but specifics are often still coming, according to four sources and communications reviewed by The Globe and Mail. The sources were not authorized to speak publicly. Some clients are very worried and remain uninformed.
Across the four firms, at least seven employees gave the hackers access, according to the Globe's reporting and confirmation from the firms. Four accounts were compromised at McCarthy Tétrault, two at Bennett Jones and one at Davies. How many were compromised at BLG is unclear. Employees who followed the callers' instructions were sent to fraudulent sign-in pages capable of bypassing multifactor authentication.
The depth of the breaches varied. Bennett Jones said its document management system, which protects client legal files and work product, was not affected, nor was its accounting system. It said the compromised information included reports on revenue from clients and, for certain clients, general descriptions of its mandates, and that it will contact those clients directly as they are identified. BLG said an internal investigation confirmed that certain files, including client-related files, were accessed by an unauthorized third party. McCarthy Tétrault said a third party gained access to certain files including client information, and Davies said it identified the compromise of information from one account.
Brent Arnold, a cybersecurity lawyer and founder of Capstan Legal, said the approach exploits the anonymity of large organizations, where people don't know all their colleagues and IT turnover can be high. A call that arrives on Teams and sounds dull enough looks real. He said such attacks often catch senior staff, who are more likely to skip security training and are always in a hurry. Google researchers have warned that the rise of these campaigns underscores the need for phishing-resistant MFA.
Still unknown in some cases, according to one source, are the hackers' identities, how they are using the stolen data, and whether the firms are monitoring the web for leaks or have found any. There is also fear of further breaches. Hackers increasingly target law firms, and this episode shows that even the largest firms, whose security budgets likely exceed the annual revenue of scores of smaller boutiques, can't always stop them.
The firms are responding together. Peter Castiel, Montreal-based chair of Stikeman Elliott LLP, said major firms and their chief information officers are sharing intelligence and best practices. Stikeman was recently targeted but not breached. He said lawyers are being urged to tell clients the full extent of the problem and the fixes under way, adding that the first and most important step is being completely transparent. McCarthy Tétrault has brought in CrowdStrike of Austin, Tex., to investigate, and BLG has hired Mandiant, a Google subsidiary. What clients are told in the coming days will show how far that transparency goes.
Citazioni salienti
The anonymity of working in a really big organization makes it easier to pull this off.— Brent Arnold, founder of Capstan Legal
The first and most important step is being completely transparent.— Peter Castiel, chair of Stikeman Elliott LLP
Vuoi la storia completa?
Leggi l'originale su The Globe and Mail ↗
Technology