Fake IT help desk calls behind the October 2026 law firm breaches: what to do this week

On October 29, 2026, The Globe and Mail reported that McCarthy Tétrault and Davies Ward Phillips & Vineberg were dealing with data breaches that compromised thousands of files, including client information. McCarthy Tétrault said it caught the breach late on October 22; Davies said a cyberattack on October 23 caused its breach, which involved information from one account. A source quoted by the Globe put the McCarthy Tétrault figure at 31,000 files. Both firms said they notified law enforcement and engaged cybersecurity experts.

The ABA Journal reported on November 2 that four Canadian firms, McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies, had disclosed recent breaches and were alerting affected clients.

On October 28, the Canadian Centre for Cyber Security issued Alert AL26-028 on an ongoing help desk voice phishing campaign. In its words, "Multiple Canadian firms have been targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages." The Cyber Centre says the activity has increasingly targeted finance and legal organizations since July, "with October activity concentrated on the legal sector." A source told the Globe the alert was spurred by the law firm cases, and that in some cases attackers used Microsoft Teams to pose as internal IT and request access to an employee's computer.

Nothing in the public reporting points to an exotic software flaw. The attack worked on people, and on the trust most offices give anyone who says they are from IT.

The call. According to the Cyber Centre alert, callers claim an urgent passkey migration, MFA enrolment or password change. They use mobile phones, desk phones or Teams, may spoof the real help desk number, name internal IT staff and hang up if the employee tries to verify.

The page. The employee lands on a sign-in page branded with the firm's name on a look-alike domain built from words like "sso", "mfa" or "passkey". It relays the password and MFA approval to the real sign-in in real time, so the attacker gets a live session. The Cyber Centre says this "bypasses conventional multi-factor authentication", and the domains rotate too fast for blocklists.

The Teams route. Microsoft described a matching pattern in a September 2026 threat report: an actor in an outside Microsoft 365 tenant opens a Teams chat as the help desk, then talks the user into approving screen-share control or reading back a Quick Assist code.

After the session, the Cyber Centre says, the attacker registers their own MFA method, deletes the security alert emails, pulls data from SharePoint and OneDrive with scripts, and sends an extortion demand.

Bay Street firms have security teams and responders on retainer, and this still got through. A small law office, accounting practice or property manager usually relies on push-notification MFA and lets any Microsoft 365 tenant in the world message its staff on Teams. That is the setup this campaign is built to beat. In the account takeovers we are called in to investigate, the starting point is usually a convincing message and a sign-in prompt someone approved, not malware.

1. 01

   1. Tell staff: IT will never call you to fix your MFA

   Send one short message today. Any unexpected call, Teams chat or text about MFA, passkeys or passwords gets the same answer: hang up and call the help desk back on the number you already have, whatever the caller ID says. Name the person or line to report it to.

2. 02

   2. Lock down external Teams access

   In the Teams admin centre, limit external chat and calls to the partner domains you actually work with instead of every Microsoft 365 tenant, and review guest accounts. This removes the Teams version of the attack.

3. 03

   3. Start phishing-resistant sign-in with the people who matter most

   Push approvals and SMS codes are what the relay pages defeat. Move administrators, partners and anyone who can release funds to passkeys, FIDO2 keys or Windows Hello for Business, which only answer the real sign-in page. Our phishing-resistant MFA guide covers the rollout.

4. 04

   4. Require managed devices and harden MFA resets

   Add a conditional access policy that only accepts sign-ins from company-managed devices, so a stolen session on an attacker's laptop fails. Write down how the help desk verifies someone before resetting MFA or enrolling a device. See our conditional access baseline.

5. 05

   5. Turn on the alerts this attack trips

   Alert on new MFA methods, on mail rules that delete security notices and on bulk SharePoint or OneDrive downloads. Confirm the unified audit log is on and kept long enough to investigate.

Do not wait to be sure. Revoke the user's sessions, reset the password, remove any MFA method or device they do not recognize, and review mailbox rules and recent file access. Preserve the Microsoft 365 and identity provider audit logs before anything is cleaned up: an insurer, regulator or court will ask for them.

If a password went into a strange page, follow what to do after entering a password on a fake login page. If the caller took control of a computer, follow what to do after giving remote access to a scammer. Then call our 24/7 incident line at (289) 582-9930 and we will contain the account, preserve the evidence and tell you what was touched.