# Voice Phishing Attacks Target Canadian Law Firms **Published on:** 2026-11-02T00:00:00.000Z **Author:** null A coordinated cyberattack targeting some of Canada's largest law firms has exposed thousands of confidential client files, highlighting the growing sophistication of voice phishing attacks and the risks associated with compromised employee credentials. In October 2026, hackers successfully breached [several prominent Canadian law firms](https://www.theglobeandmail.com/business/article-law-firms-hackers-how-did-it-happen-client-files-voice-phishing/), including McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones, and Borden Ladner Gervais (BLG). The attackers reportedly used voice phishing, also known as vishing, to impersonate internal IT support employees and convince lawyers and other staff members to provide access to their accounts. The incidents affected at least seven employee accounts across the firms. At McCarthy Tétrault alone, approximately 31,000 files were reportedly stolen, according to sources familiar with the investigation. Unlike attacks that exploit software vulnerabilities or deploy malicious code, this campaign relied primarily on social engineering. Attackers contacted employees through telephone calls and Microsoft Teams, creating convincing scenarios involving password resets, security updates, and IT troubleshooting. Employees who followed the instructions were directed to fraudulent sign-in pages designed to capture credentials and bypass multi-factor authentication (MFA). The resulting compromises gave attackers access to internal systems containing sensitive client information, including confidential business records, financial information, legal communications, and potentially privileged documents. The incident demonstrates why even organizations with substantial cybersecurity budgets remain vulnerable to attacks that exploit human trust. For law firms, financial institutions, and other organizations handling confidential information, the breaches offer an important reminder: protecting accounts requires more than strong passwords and MFA. Organizations must also verify identities, monitor authentication activity, and prepare employees to recognize increasingly sophisticated [social engineering techniques](law.com/international-edition/2026/10/30/2-canadian-firms-fall-prey-to-industry-wide-cyberattack/?slreturn=20261102100000). ## **What Happened in the October 2026 Canadian Law Firm Cyberattacks?** In October 2026, several prominent Canadian law firms experienced cyberattacks involving unauthorized access to employee accounts and confidential client information. The affected firms included: * McCarthy Tétrault LLP * Davies Ward Phillips & Vineberg LLP * Bennett Jones LLP * Borden Ladner Gervais LLP (BLG) The incidents appear to have been part of a broader campaign targeting Canadian legal organizations rather than isolated attacks against individual firms. According to reporting by The Globe and Mail, attackers contacted employees while impersonating members of their organization's IT department. Some interactions took place through Microsoft Teams, while others involved telephone calls that appeared to originate from legitimate internal IT numbers. The attackers claimed that employees needed to complete security updates, resolve password issues, or take other actions involving their accounts. At least seven employees across the affected firms reportedly granted attackers access to internal files. The extent of the compromise varied between organizations. McCarthy Tétrault confirmed that an unauthorized third party accessed files containing client information. Four employee accounts were reportedly compromised, and approximately 31,000 files were stolen, according to a source directly involved in the response. Davies Ward Phillips & Vineberg identified unauthorized access involving one employee account following an incident on October 23. Bennett Jones confirmed that certain client-related information had been compromised. However, the firm stated that its document management and accounting systems were not affected. The exposed information included client revenue reports and general descriptions of certain client mandates. BLG also confirmed that an unauthorized third party accessed certain files, including client-related documents, within part of its Microsoft cloud environment. The firms engaged external cybersecurity specialists to investigate the incidents and determine the scope of the compromised information. McCarthy Tétrault brought in CrowdStrike, while BLG engaged Mandiant, a cybersecurity consulting firm owned by Google. Several other major Canadian law firms, including Osler, Goodmans, Fasken, and Blake, Cassels & Graydon, reported that they had not been affected by the campaign. The attacks prompted increased concern across Canada's legal sector, particularly because law firms routinely maintain information that would be highly valuable to cybercriminals, corporate competitors, and other threat actors. ## **What is Voice Phishing (Vishing)?** [Voice phishing](https://www.packetlabs.net/posts/vishing/), commonly called "vishing", is a form of social engineering in which attackers use telephone calls, voice messages, or internet-based calling platforms to manipulate individuals into revealing sensitive information or granting unauthorized access. Traditional phishing attacks typically rely on fraudulent emails or messages containing malicious links, attachments, or requests for credentials. Vishing uses direct communication to create a more convincing interaction. An attacker may impersonate an IT employee, technical support representative, financial institution, government agency, or business partner. By establishing a sense of legitimacy and urgency, the attacker attempts to convince the target to follow instructions that compromise their security. The Canadian law firm attacks demonstrate how effective this approach can be when attackers impersonate trusted internal employees. ## **Why Vishing is Effective** People are generally accustomed to receiving legitimate requests from IT departments. Employees may be asked to reset passwords, install software updates, enroll in MFA, troubleshoot applications, or provide access to technical support personnel. Attackers exploit these familiar processes. Rather than immediately requesting a password, a threat actor may guide an employee through what appears to be a routine troubleshooting procedure. The attacker can establish credibility by referencing familiar software, internal terminology, organizational procedures, or a seemingly legitimate technical problem. This is particularly effective in large organizations where employees may not personally know everyone working in IT. An employee who receives a Microsoft Teams call from someone claiming to be part of the help desk may have little reason to question the interaction, especially if the caller sounds professional and appears familiar with internal systems. The threat actor does not necessarily need to exploit a technical vulnerability. They only need to convince someone to perform an action that provides unauthorized access. ## **Why Large Organizations Are Attractive Targets** Large law firms have complex organizational structures, numerous employees, multiple offices, and extensive technology environments. This creates opportunities for attackers to exploit gaps in familiarity and communication. Employees may interact with colleagues they have never met in person, while IT departments may routinely provide remote support through telephone calls and collaboration platforms. These conditions can make impersonation attacks particularly convincing. Senior employees may also be attractive targets because they frequently have access to sensitive information and may operate under significant time constraints. An attorney managing several client matters may be more inclined to quickly resolve an apparent technical issue rather than spend time verifying the identity of an unfamiliar IT representative. Attackers exploit this combination of trust, urgency, and access. ## **How Hackers Used Vishing to Bypass Multi-Factor Authentication** One of the most concerning aspects of the Canadian law firm attacks is that the attackers reportedly used fraudulent sign-in pages capable of bypassing multi-factor authentication. This is significant because MFA is widely considered one of the most effective defenses against account compromise. When implemented correctly, MFA requires users to provide an additional authentication factor beyond their password. This may involve an authentication application, a one-time code, a hardware security key, or a biometric verification method. However, not all [MFA implementations](https://www.packetlabs.net/posts/why-multi-factor-authentication-is-not-enough/) provide the same level of protection. Sophisticated phishing attacks can exploit weaknesses in the authentication process itself. ### **Step 1: Impersonating Internal IT Support** The attack begins with an attacker contacting an employee while pretending to be a member of the organization's IT department. The interaction may involve a telephone call or [Microsoft Teams](https://www.packetlabs.net/posts/microsoft-vulnerabilities/) message. The attacker creates a plausible reason for contacting the employee, such as an expired password, an account security issue, or a required software update. By presenting the request as routine technical support, the attacker reduces the likelihood that the employee will question its legitimacy. ### **Step 2: Directing the Employee to a Fake Sign-In Page** The attacker then instructs the employee to visit a website that resembles a legitimate corporate login portal. The fraudulent page may closely imitate Microsoft authentication services or another platform used by the organization. Because the page appears familiar, the employee may not recognize that it is controlled by the attacker. The employee enters their username and password, unknowingly providing those credentials to the threat actor. ### **Step 3: Capturing Multi-Factor Authentication Responses** The attackers reportedly used phishing infrastructure capable of intercepting authentication information in real time. This technique is commonly associated with [adversary-in-the-middle (AiTM) phishing](https://www.packetlabs.net/posts/blackwood-apt-uses-aitm-attacks-to-target-software-updates/). Rather than simply collecting a password for later use, the attacker's infrastructure acts as an intermediary between the victim and the legitimate authentication service. When the employee enters their credentials, the fraudulent website forwards the information to the real login service. The legitimate service then requests the employee's second authentication factor. The attacker relays that request through the fraudulent page, prompting the employee to complete what appears to be a normal authentication process. If the employee successfully provides the MFA code or approves the authentication request, the attacker may capture the resulting authenticated session. This can provide access without requiring the attacker to independently complete the authentication process. ### **Step 4: Obtaining an Authenticated Session** Once the authentication process succeeds, the legitimate service may issue a session token or authentication cookie. This token allows the user to remain authenticated without repeatedly entering their password and completing MFA. Depending on the authentication configuration and the type of token obtained, attackers may be able to reuse the captured session to access corporate applications. This is particularly dangerous because the attacker may now possess a valid authenticated session rather than simply a stolen password. Traditional security controls focused on preventing unauthorized password usage may not immediately detect this type of compromise. ### **Step 5: Accessing Confidential Client Information** With access to a compromised employee account, attackers may attempt to access files, email communications, cloud applications, and other internal resources. The information available depends on the employee's permissions and the organization's access controls. In the Canadian law firm incidents, compromised accounts reportedly provided access to confidential client-related files. This illustrates how a seemingly minor social engineering interaction can escalate into a significant data breach. A single compromised account may expose information belonging to multiple clients, particularly when employees have access to shared document repositories or cloud-based collaboration environments. ### **What is Adversary-in-the-Middle Phishing?** The use of fraudulent sign-in pages to bypass MFA makes adversary-in-the-middle phishing an important part of understanding the law firm breaches. AiTM phishing involves an attacker positioning malicious infrastructure between a legitimate user and an authentication service. Rather than simply creating a fake login page that collects passwords, attackers use a reverse-proxy setup to relay authentication requests to the legitimate service in real time. This allows them to capture credentials, authentication responses, and potentially session cookies. ## **How AiTM Attacks Differ From Traditional Phishing** Traditional phishing typically involves collecting credentials through a fraudulent website or email. An attacker may use those credentials to attempt to log in to the victim's account later. However, if the account is protected by MFA, the attacker may encounter an additional authentication requirement. AiTM phishing addresses this limitation by relaying the authentication process between the victim and the legitimate service. The victim believes they are logging in normally, while the attacker intercepts the communication. This can allow attackers to capture authenticated sessions even when MFA is enabled. ## **Why Session Token Theft is So Dangerous** [Session tokens](https://www.packetlabs.net/posts/session-management/) are designed to maintain authenticated access after a user successfully logs in. They allow applications to recognize that a user has already completed authentication without requiring them to enter their credentials repeatedly. However, if an attacker steals a valid session token, they may be able to impersonate the authenticated user. Depending on the service and its security configuration, the attacker may not need to provide the original password or repeat the MFA process. This creates a significant challenge for organizations relying on traditional authentication controls. Even when employees use MFA, their accounts may remain vulnerable if attackers can steal authenticated sessions. Phishing-resistant authentication methods, particularly FIDO2 security keys and passkeys, provide stronger protection because authentication is cryptographically bound to the legitimate website's domain. This makes it significantly more difficult for an attacker to relay authentication through a fraudulent website. ## **Why Law Firms Are Attractive Targets for Cybercriminals** Law firms are particularly valuable targets because they maintain extensive collections of sensitive information belonging to individuals, businesses, government organizations, and other institutions. Unlike many businesses, law firms routinely receive information that clients may not disclose publicly or even share internally with other departments. This makes legal organizations attractive targets for several categories of threat actors. ## **Access to Confidential Business Information** Corporate law firms regularly manage sensitive information related to mergers and acquisitions, business transactions, corporate restructuring, intellectual property, and strategic negotiations. An attacker who obtains access to these records may gain insight into transactions that have not yet been publicly announced. Such information could potentially be exploited for financial gain, corporate espionage, extortion, or competitive intelligence. For example, confidential acquisition documents could reveal the identity of a potential buyer, the proposed transaction value, or the strategic plans of a company. The exposure of this information could have significant financial and reputational consequences. ## **Attorney-Client Privilege and Confidential Communications** Law firms also maintain privileged communications between attorneys and their clients. These records may include legal advice, litigation strategies, internal investigations, and assessments of potential legal exposure. Although unauthorized access to privileged documents does not automatically eliminate attorney-client privilege, it can create significant legal and operational complications. Clients may need to assess whether sensitive information has been exposed, whether it could be used by opposing parties, and whether additional protective measures are necessary. ## **Financial and Personal Information** Legal organizations also maintain personal information associated with employees, clients, witnesses, and other individuals. This may include financial statements, tax records, banking information, government identification, employment records, and health information. Such information can be valuable to cybercriminals conducting identity theft, financial fraud, or targeted social engineering campaigns. The combination of confidential legal information and personal data makes law firms especially attractive targets. ## **Law Firms as a Gateway to Other Organizations** Compromising a [law firm](https://www.packetlabs.net/posts/cybersecurity-solutions-law-enforcement/) may also provide attackers with information about its clients, suppliers, and business relationships. Threat actors could use exposed communications to identify executives, financial contacts, transaction participants, and other individuals who may be targeted in subsequent attacks. In this way, a breach involving an external legal service provider can potentially create risks for organizations whose own networks remain secure. Companies should therefore recognize that third-party professional services providers can represent an important part of their overall cybersecurity risk. ## **How Canadian Law Firms Responded to the Attacks** Following the breaches, affected law firms engaged external cybersecurity specialists to investigate the incidents, identify compromised information, and contain unauthorized access. The firms also began notifying affected clients and coordinating their response with relevant authorities. ### **McCarthy Tétrault** McCarthy Tétrault confirmed that an unauthorized third party accessed certain files, including information relating to clients. Four employee accounts were reportedly compromised, with approximately 31,000 files stolen. The firm engaged CrowdStrike to investigate the incident and determine the extent of the exposure. ### **Davies Ward Phillips & Vineberg** Davies confirmed that it identified the compromise of information associated with one account following an October 23rd cyberattack. The firm initiated an investigation and worked to assess the information involved. ### **Bennett Jones** Bennett Jones confirmed that certain client-related information had been accessed. The firm stated that its document management system and accounting system were not affected. The compromised information included client revenue reports and general descriptions of certain client mandates. The firm said it would contact affected clients as their identities were established. ### **Borden Ladner Gervais** BLG confirmed that certain files, including client-related documents, were accessed by an unauthorized third party. The firm engaged Mandiant to investigate the incident and assess the scope of the compromise. Its investigation identified unauthorized access within part of its Microsoft cloud environment. ### **Other Firms Targeted by the Campaign** The attacks were not limited to the four firms that confirmed breaches. Other major Canadian law firms, including Stikeman Elliott, reported being targeted by attackers but did not confirm successful compromises. Stikeman Elliott's chair indicated that major Canadian firms were sharing threat intelligence and best practices to better understand the campaign and strengthen their defenses. This collaboration is important because coordinated attacks often involve techniques that can be reused against multiple organizations. Information sharing allows security teams to identify common indicators of compromise, recognize suspicious activity, and respond more quickly to emerging threats. ## **How Organizations Can Prevent Voice Phishing Attacks** The Canadian law firm breaches demonstrate that traditional cybersecurity awareness training and MFA are not always sufficient to prevent account compromise. Organizations need layered security controls that address both the human and technical elements of [social engineering attacks](https://www.packetlabs.net/services/social-engineering/). Several measures can help reduce the risk of vishing and AiTM phishing. ### **1\. Implement Phishing-Resistant MFA** Organizations should prioritize phishing-resistant authentication methods such as [FIDO2 security keys and passkeys](https://www.packetlabs.net/posts/the-benefits-and-flaws-of-fido2-web-authentication/). Unlike traditional one-time passwords and push notifications, these methods use cryptographic authentication tied to the legitimate website or service. This makes it significantly more difficult for attackers to capture and reuse authentication credentials through fraudulent sign-in pages. Organizations should also review legacy authentication methods and disable weaker options wherever practical. ### **2\. Establish Strict IT Support Verification Procedures** Employees should never assume that an unexpected telephone call or Microsoft Teams message is legitimate simply because the caller claims to work in IT. Organizations should establish clear procedures for verifying technical support requests. For example, employees should be instructed to end unexpected calls and contact the IT department through an independently verified telephone number or internal support portal. IT departments should also avoid requesting passwords, MFA codes, or authentication approvals from employees. These procedures help prevent attackers from exploiting the trust employees place in internal technical support teams. ### **3\. Monitor Authentication and Session Activity** Organizations should monitor authentication events for suspicious patterns, including unusual login locations, unfamiliar devices, abnormal session activity, and unexpected access to sensitive applications. Security teams should also evaluate whether their identity platforms can detect suspicious session token usage. When an account is suspected of compromise, response procedures should include revoking active sessions and authentication tokens, resetting credentials, and reviewing associated account activity. Simply changing a password may not be sufficient if an attacker already possesses a valid authenticated session. ### **4\. Implement Conditional Access Policies** Conditional access policies can help organizations evaluate authentication requests based on contextual information. Depending on the identity platform, policies may consider device compliance, user identity, location, application, and authentication strength. Organizations can use these controls to restrict access from unmanaged devices or require additional verification when a login attempt presents unusual risk indicators. Conditional access should also be configured to prevent weaker authentication methods from providing access to particularly sensitive applications. ### **5\. Apply the Principle of Least Privilege** Employees should only have access to the systems and information required to perform their responsibilities. If an attacker compromises an employee account, restricted permissions can help prevent access to unrelated client files, financial systems, and administrative environments. Law firms should regularly review document repository permissions, shared folders, cloud application access, and administrative privileges. Sensitive client matters should be appropriately separated so that compromising one account does not automatically expose an entire organization's document environment. ### **6\. Improve Employee Security Awareness** Employees should receive regular training on social engineering techniques, including vishing, phishing, impersonation, and MFA fatigue attacks. Training should reflect the actual methods attackers use rather than relying exclusively on generic examples of suspicious emails. Employees should understand that attackers may contact them through Microsoft Teams, telephone calls, text messages, and other legitimate communication platforms. They should also be taught to recognize warning signs such as unexpected password reset requests, urgent security updates, requests for remote access, and instructions to approve unfamiliar MFA prompts. Regular simulations can help organizations evaluate whether employees recognize and report suspicious interactions. ### **7\. Conduct Regular Penetration Testing** Security assessments should evaluate whether attackers could compromise employee accounts, bypass authentication controls, escalate privileges, or access sensitive information. Penetration testing can help identify weaknesses across identity infrastructure, cloud applications, internal networks, and external attack surfaces. Organizations should also conduct authorized social engineering assessments to evaluate how effectively employees respond to impersonation attempts. The objective is to identify weaknesses before threat actors can exploit them. ### **Why Continuous Security Testing Matters** The law firm attacks demonstrate that cybersecurity weaknesses do not always originate from software vulnerabilities. In this case, attackers reportedly relied on social engineering and authentication interception to gain access to legitimate accounts. This highlights the importance of testing security controls against realistic attack scenarios. Traditional vulnerability scanning can identify known software weaknesses, outdated systems, and configuration issues. However, it may not reveal whether an attacker could successfully impersonate IT support, compromise an employee's identity, or steal an authenticated session. Penetration testing provides a more comprehensive assessment. ### **Testing Identity and Authentication Controls** Identity-driven penetration testing evaluates whether attackers could obtain unauthorized access through weak authentication configurations, excessive permissions, or insecure identity management practices. Testing can identify opportunities for privilege escalation, account compromise, and lateral movement. For organizations using Microsoft 365 and other cloud platforms, this can include evaluating authentication policies, conditional access, service accounts, and application permissions. ### **Testing Cloud Environments** The breaches also highlight the importance of securing cloud-based document management and collaboration platforms. Cloud penetration testing can evaluate whether access controls, storage configurations, integrations, and administrative permissions are properly implemented. Security professionals can assess whether compromising one employee account could expose sensitive files or provide access to additional systems. ### **Testing the Human Attack Surface** Social engineering assessments can help organizations understand how employees respond to realistic impersonation attempts. Authorized testing may evaluate whether employees verify unexpected IT requests, recognize suspicious authentication pages, and report unusual activity. These assessments can identify gaps in employee awareness and internal procedures. They can also help organizations determine whether their security culture encourages employees to question unusual requests rather than simply following instructions from someone claiming to be an authority. ### **Continuous Penetration Testing and Security Validation** Security testing should not be treated as a one-time compliance exercise. Organizations regularly introduce new applications, modify authentication policies, onboard employees, and integrate additional technology platforms. Each change can introduce new vulnerabilities. Continuous security validation, supported by regular penetration testing and proactive monitoring, helps organizations determine whether their controls remain effective as their environments evolve. For law firms, financial institutions, and other organizations managing highly confidential information, this ongoing approach is essential to reducing the likelihood and impact of account compromise. ## **Conclusion** The Canadian law firm breaches highlight a broader shift in the cybersecurity threat landscape. Attackers are increasingly combining social engineering with technical infrastructure designed to bypass conventional security controls. Rather than attempting to break through a company's defenses directly, threat actors may target employees who already have legitimate access to sensitive systems. This approach can be effective because it exploits the trust relationships that allow organizations to operate. The increasing use of cloud-based applications and remote collaboration platforms also creates more opportunities for impersonation. Employees routinely interact with colleagues, vendors, and technical support personnel through digital communication channels. This can make it difficult to distinguish legitimate requests from carefully constructed attacks. Advances in artificial intelligence may further complicate the problem. Threat actors can potentially use AI-generated scripts, voice impersonation, and automated communications to make social engineering campaigns more convincing and scalable. Organizations must therefore prepare for attacks that are personalized, persistent, and increasingly difficult to identify through traditional awareness training alone. The response requires a combination of phishing-resistant authentication, strong identity management, employee verification procedures, security monitoring, and continuous testing. Ultimately, the Canadian law firm breaches demonstrate that cybersecurity is not simply about preventing unauthorized access to technology. It is about ensuring that the people and processes responsible for accessing sensitive information are protected against manipulation. A single convincing telephone call can potentially undermine millions of dollars in cybersecurity investments. Organizations must ensure that their employees have the training, tools, and procedures necessary to recognize these threats before attackers gain access. For law firms and businesses handling confidential information, protecting client trust begins with securing every identity, device, and interaction that connects employees to critical systems.