Multiple Bay Street Law Firms Confirm Data Breaches

A group of major Canadian law firms have announced successive data breaches. Bennett Jones LLP said on October 19 that two accounts belonging to its business services staff were compromised, while Borden Ladner Gervais (BLG) disclosed that a third party gained unauthorized access to part of its Microsoft cloud environment. The Globe and Mail reported that at least four Bay Street law firms were targeted in this campaign.

According to the firms, the impact at Bennett Jones may include the leakage of client revenue reports and summaries of some matters, although the firm says its document management and accounting systems were not compromised. BLG has retained Mandiant (the cybersecurity firm under Google) to assist with investigation and remediation and is working to identify the scope of the impact and take corrective measures.

Reports indicate that McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP have also confirmed the exposure of thousands of files. Attackers used social engineering tactics posing as internal IT staff, directing employees via Microsoft Teams and fake sign-in pages, and the Canadian Centre for Cyber Security has issued an advisory warning about these methods.

Not all targeted firms were successfully breached: Stikeman Elliott and Gowling WLG were also attacked but the attempts were stopped and no customer data leakage has been confirmed. Each firm has reported the incidents to law enforcement and is notifying affected clients, while CIOs are sharing information and discussing measures to prevent recurrence.