Data Breaches Hit Multiple Bay Street Law Firms in Coordinated Cyber Campaign
Bennett Jones LLP and Borden Ladner Gervais LLP confirmed they were compromised in a broader cyberattack targeting at least four Bay Street law firms, including McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP. Hackers impersonated internal IT support to access Microsoft cloud environments and employee accounts.
A coordinated cyber campaign has compromised data at multiple prominent Canadian law firms, with Bennett Jones LLP and Borden Ladner Gervais LLP (BLG) confirming breaches as part of attacks targeting at least four Bay Street firms.
McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP are also dealing with data breaches that have compromised thousands of files in total, including client information. All breached firms have notified law enforcement and are reaching out to affected clients.
David Di Paolo, national managing partner and CEO of BLG, stated that an unauthorized third party accessed a portion of the firm’s Microsoft cloud environment, including files related to clients. BLG engaged Mandiant, a cybersecurity consulting firm and Google subsidiary, to investigate the incident and support remediation.
Bennett Jones reported that two of its business services employees’ user accounts were compromised on Oct. 19 as part of the larger campaign targeting Canadian law firms. The firm stated the stolen information includes revenue reports from clients and general descriptions of the firm’s mandates for those clients. Bennett Jones confirmed its document management system and accounting system were not breached.
The Canadian Centre for Cyber Security cautioned that multiple Canadian firms have been targeted by cybercriminals impersonating internal IT support and directing employees to fraudulent sign-in pages. At least some of the breaches involved hackers using Microsoft Teams and posing as internal IT employees to request access to an employee’s computer.
Gowling WLG was also targeted by the hackers but found no evidence that its systems or client information were compromised after working with an external cybersecurity firm.