In October 2026, four top Canadian law firms faced a coordinated cyberattack exposing client data.
Why it matters: Law firms hold highly sensitive client information, making them prime targets for cyber threats. This incident underscores the urgent need for robust cybersecurity, swift breach responses, and transparent client communications to maintain confidentiality and meet regulatory obligations.
- McCarthy Tétrault detected unauthorized access on October 22 and notified affected clients by October 25.
- Davies Ward Phillips & Vineberg confirmed a breach on October 23 compromising a single account.
- Bennett Jones reported on October 19 that employee accounts were compromised, exposing client revenue reports and mandate descriptions.
- Borden Ladner Gervais found unauthorized access to part of its Microsoft cloud and hired Mandiant to investigate.
In October 2026, four major Canadian law firms—
McCarthy Tétrault,
Borden Ladner Gervais (BLG),
Bennett Jones, and
Davies Ward Phillips & Vineberg—were struck by a coordinated cyberattack exposing sensitive client information.
McCarthy Tétrault discovered unauthorized access to client files on October 22 and promptly informed affected clients by October 25. On October 23, Davies Ward Phillips & Vineberg confirmed the breach affected a single account.
On October 19, Bennett Jones reported that two employee accounts in business services were compromised, leading to exposure of client revenue data and mandate details. BLG detected unauthorized access to part of its Microsoft cloud environment, including client files, and engaged the cybersecurity firm Mandiant to lead the investigation.
The
Canadian Centre for Cyber Security issued an alert on October 28 regarding an active voice phishing (vishing) campaign targeting law firms, linked to recent breaches. Vishing involves attackers using phone calls to trick victims into revealing confidential information.
David Di Paolo, BLG’s National Managing Partner & CEO, stressed the firm’s dedication to client confidentiality: “We have and continue to reach out directly to affected clients to keep them informed and are taking every step necessary to protect their information.”
These breaches highlight the legal sector’s increasing cyber risks. They demonstrate the critical need for strong security controls, rapid detection, and transparent communication to protect client data and comply with privacy regulations.
By the numbers:
- 4 — major Canadian law firms hit in October 2026
- October 19–25 — dates firms detected or disclosed breaches
- October 28 — Canadian Centre for Cyber Security vishing alert issued