Four Bay Street law firms confirm data breaches in phishing campaign

Four firms confirm breaches

McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies Ward Phillips & Vineberg disclosed the breaches this past week, Law360 reported. The firms said damage has been contained and that they are alerting affected parties, according to Law.com. The Globe and Mail reported that the campaign has successfully infiltrated at least four Bay Street law firms.

The Canadian Centre for Cyber Security cautioned that multiple Canadian firms have been targeted by cybercriminals impersonating internal IT support and directing employees to fraudulent sign-in pages, the Globe reported. The agency issued a warning about an ongoing phishing campaign targeting organizations in the legal and financial sectors, the ABA Journal reported.

What the firms have disclosed

BLG national managing partner and CEO David Di Paolo said an unauthorized third party accessed "a portion" of the firm's Microsoft cloud environment, including files related to clients. BLG engaged Mandiant, a cybersecurity consulting firm and Google subsidiary, to investigate the incident, determine the scope and support remediation, Di Paolo said in a statement to The Globe and Mail.

Bennett Jones said two business services employees' user accounts were compromised on 19 October as part of a "larger campaign targeting Canadian law firms." The firm said it detected the activity immediately and took steps to contain, investigate and assess the affected data. The stolen information includes revenue reports from clients and, in some cases, general descriptions of the firm's mandates for those clients. Bennett Jones said its document management system, where legal files are held, and its accounting system were not breached.

The Globe and Mail reported on Thursday that McCarthy Tétrault and Davies are also dealing with data breaches involving client information, and that the breaches have compromised thousands of files in total. The public accounts describe different scales: two compromised accounts at Bennett Jones, a portion of BLG's Microsoft cloud environment, and thousands of files in total in the McCarthy Tétrault and Davies breaches.

How the attackers got in

The Globe previously reported that at least some of the breaches at law firms involved hackers using Microsoft Teams and posing as internal IT employees to request access to an employee's computer.

The hackers also targeted Stikeman Elliott and Gowling WLG but did not succeed, the Globe reported. Richard McConnell, Gowling's chief technology and operating officer, said an external cybersecurity firm found no evidence that its systems or client information were compromised. "We continue to monitor for related activity," McConnell said. Peter Castiel, Montreal-based chair of Stikeman Elliott, said major law firms and their chief information officers are sharing intelligence and best practices.

What happens next

The firms said they have engaged cybersecurity companies to investigate and remediate, according to Law.com. The ABA Journal reported growing concern that cyberattacks are increasingly aimed at the legal and financial industries.

All of the firms that were breached have notified law enforcement and are reaching out to affected clients, the Globe reported.