Bennett Jones hit in data breach targeting Bay Street law firms

Bennett Jones LLP and Borden Ladner Gervais LLP have confirmed that they were compromised by data breaches as part of a broader campaign that has successfully infiltrated at least four Bay Street law firms.

David Di Paolo, national managing partner and CEO of BLG, said an unauthorized third party accessed “a portion” of the firm’s Microsoft cloud environment, including files related to clients. The firm engaged Mandiant, a cybersecurity consulting firm and Google subsidiary, to investigate the incident, determine the scope of the breach and support remediation, Mr. Di Paolo said in a statement provided to The Globe and Mail.

Bennett Jones said two of its business services employees’ user accounts were compromised on Oct. 19 as part of what it called a “larger campaign targeting Canadian law firms.”

McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP are also dealing with data breaches that have compromised thousands of files in total, including client information, The Globe reported on Thursday.

All of the firms that were breached have notified law enforcement and are reaching out to affected clients.

The Canadian Centre for Cyber Security on Wednesday cautioned that multiple Canadian firms have been targeted by cybercriminals impersonating internal IT support and directing employees to fraudulent sign-in pages.

The Globe previously reported that at least some of the breaches at law firms involved hackers using Microsoft Teams and posing as internal IT employees to request access to an employee’s computer.

Bennett Jones said the information stolen includes revenue reports from clients and, in some cases, general descriptions of the firm’s mandates for those clients.

However, the firm’s document management system, where legal files are contained, and its accounting system was not breached, Bennett Jones said in a notice on its website.

“We immediately detected the activity and took steps to contain, investigate and assess the affected data in scope,” the firm said in the statement .

The hackers targeted other firms as well, but in some cases, don’t appear to have succeeded. Gowling WLG was one of those firms.

Richard McConnell, Gowling’s chief technology and operating officer, said the firm worked with an external cybersecurity firm to investigate attempted attacks, and found no evidence that its systems or client information were compromised.

“We continue to monitor for related activity,” Mr. McConnell said.