In late October 2026, four prominent Canadian law firms—McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones, and Davies Ward Phillips & Vineberg—fell victim to a coordinated cyberattack targeting the legal sector. The breaches, which involved unauthorized access to sensitive client information, have raised significant concerns about cybersecurity within the legal industry.
McCarthy Tétrault detected an intrusion on October 22, 2026, when an unauthorized party accessed certain files containing client information. The firm promptly engaged a cybersecurity firm, notified affected clients by October 25, and informed law enforcement and professional regulators. The Globe and Mail, which first reported the breach, later indicated that Davies was also affected, with thousands of files compromised. ([lexcircuit.com](https://lexcircuit.com/story/mccarthy-tetrault-data-breach-client-files-2026-10/?utm_source=openai))
Davies Ward Phillips & Vineberg confirmed a cyberattack on October 23, 2026, resulting in the compromise of information from one account. The firm engaged cybersecurity experts, notified law enforcement, and began contacting clients. The Canadian Centre for Cyber Security issued an alert on October 28, warning of an ongoing campaign where attackers impersonate internal IT support to steal credentials, with recent activity concentrated on the legal sector. ([lexcircuit.com](https://lexcircuit.com/story/davies-ward-phillips-vineberg-cyberattack-legal-vishing-alert-2026-10/?utm_source=openai))
Bennett Jones reported that on October 19, 2026, two business services employees’ user accounts were compromised as part of a larger campaign targeting Canadian law firms. The firm stated that the stolen information includes revenue reports from clients and, in some cases, general descriptions of the firm’s mandates for those clients. However, the firm’s document management and accounting systems were not breached. ([thecanadanation.com](https://thecanadanation.com/bennett-jones-hit-in-data-breach-targeting-bay-street-law-firms/?utm_source=openai))
Borden Ladner Gervais has not publicly confirmed whether it was affected by the cyberattack. The firm, established in 1823, is one of Canada’s largest law firms, with offices in Toronto, Montréal, Vancouver, Ottawa, and Calgary. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Borden_Ladner_Gervais?utm_source=openai))
These incidents underscore the growing threat of cyberattacks targeting the legal sector, emphasizing the need for robust cybersecurity measures to protect sensitive client information.