Canadian Law Firm Breaches: When “IT Support” Is the Attacker

A caller says your password has expired. They sound professional, understand the urgency of your work, and offer to stay on the line while you fix it. The call appears to come from your IT department. It may even arrive through Microsoft Teams.

For a lawyer trying to get back to a client matter, following those instructions can feel like the sensible thing to do.

That is the opening attackers exploited in a wave of Canadian law firm breaches, according to reporting by The Globe and Mail. The incidents raise a practical question for every firm: When someone claims to be IT support, how does your team check before granting access?

What happened at the Canadian law firms?

The Globe reported breaches involving McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones, and Borden Ladner Gervais. Attackers impersonated IT personnel, using calls about urgent updates or password problems to persuade employees to follow their instructions.

The reported impact varied. McCarthy Tétrault and BLG acknowledged unauthorized access to files that included client information. Davies described compromised information from one account. Bennett Jones said its document management and accounting systems were unaffected, while compromised information included client revenue reports and, for certain clients, general descriptions of the firm's work.

Those differences matter. A breach does not mean every client file was accessed, and investigations were still establishing the extent of the exposure at the time of reporting. Even so, the incidents show how an apparently routine support conversation can reach information clients expect a firm to protect.

For a smaller practice, that information might be a settlement position, an estate plan, medical records, or documents relating to a business sale. The value to an attacker comes from the information and the pressure its disclosure could create, regardless of the firm's size.

Why a helpful IT call can be so persuasive

Vishing, or voice phishing, uses a conversation to persuade someone to reveal information or authorize access. A caller can answer questions, explain away hesitation, and keep the employee focused on completing an urgent task.

The setting helps. Staff expect IT to ask them to troubleshoot software, resolve sign-in problems, or use remote support. An attacker borrows that familiar process and introduces one dangerous step: opening an unfamiliar sign-in page, approving an unexpected authentication request, or allowing remote control.

In separate research on IT-support impersonation, Microsoft described attackers using external Teams contact to persuade employees to grant remote access. Its guidance calls for verifying unsolicited support requests through a known internal channel.

The training lesson is broader than spotting a suspicious email. Employees need to recognize when a conversation is asking them to cross an access boundary, even if the person sounds competent and the application looks familiar.

MFA still matters. The method matters, too.

The Globe reported that employees were directed to fraudulent sign-in pages capable of bypassing MFA protections. That makes the question “Do we have MFA?” only the start of the discussion.

Google Threat Intelligence Group has documented separate campaigns in which fake helpdesk calls lead employees to lookalike sign-in portals that intercept credentials and authentication tokens. Google recommends phishing-resistant authentication, including FIDO2 security keys and passkeys, to address this attack path.

Ask whoever manages your accounts which methods are enforced for email and document access, whether weaker sign-in options remain available, and how password resets and new authentication methods are verified. Our MFA verification guide for law firms explains the account coverage and evidence to check. Training should reinforce those controls so an unexpected caller cannot talk someone through changing them.

Give staff a response they can use under pressure

“Be careful” leaves the employee to improvise while a convincing caller waits. A firm-wide verification process gives them something concrete to do:

1. Pause before granting access. Do not open a caller's sign-in link, install support software, share authentication codes, or approve an unexpected prompt.
2. End the conversation and contact IT independently. Use the firm's saved support number or established portal. A number or link supplied by the caller does not provide an independent check.
3. Confirm the request and the person. Ask the approved support team to verify the technician, the work, and the action being requested. A plausible ticket number alone is insufficient.
4. Report anything already done. If someone entered credentials or granted access, tell verified IT support immediately. Preserve messages and explain what happened; ending the call does not necessarily end the attacker's access.

Staff can keep the wording simple: “Our firm verifies unexpected support requests. I'll contact IT through our approved number before we continue.”

Our law firm IT-support verification checklist and callback script can help you put that process into practice. Leadership should make clear that taking time to verify a request is supported, including when the caller claims the issue is urgent.

Make the safer response familiar before the next call

A written procedure becomes more useful when people have practiced using it. Include partners, attorneys, assistants, and administrators. Give them realistic decisions involving unexpected sign-ins, urgent support requests, document shares, and authentication prompts.

Review whether people know where to report a concern and how to reach trusted support. Use your incident response plan to name the people responsible for receiving and acting on those reports. Encourage prompt reporting even after a mistake, so embarrassment does not delay the firm's response.

Would your team know what to do if that call arrived today?

Securing Your Law Firm's cybersecurity training gives attorneys and staff short weekly challenges built around legal work, with feedback explaining the safer decision. Office managers can track completion and scores and follow up where employees need more practice.

Explore Cybersecurity Training for Law Firms →

Keep building your firm’s verification habits

• Phishing Training for Law Firms: What to Test and Measure — Choose realistic exercises and use reporting and follow-up to assess progress.
• Baker McKenzie and Troutman Pepper Locke Data Breaches: Lessons for Law Firms — Examine separate incidents involving social engineering and document disclosures.
• Sheppard Mullin Breach: Lessons for Small Law Firms — Consider how verification applies to requests for client documents.