Corporate law firm McCarthy Tétrault hit by data breach

McCarthy Tétrault, one of Canada’s top corporate law firms, is dealing with a major data breach that has compromised thousands of files, including client information.

The breach occurred over the last week, according to two sources familiar with the matter, and one source directly involved said 31,000 files were stolen.

The Globe and Mail is not naming the sources because they are not authorized to speak publicly about the matter.

McCarthy Tétrault confirmed the breach to The Globe and Mail, but declined to comment on the number of affected files.

The firm, which advises on some of the highest profile deals in Canada, has been reaching out to Bay Street clients this week and informing them of the breach. Clients are currently in the process of learning what information has been compromised.

While data breaches have increased in frequency, it is rare to see one in the legal field.

As a corporate law firm, McCarthy Tétrault advises on mergers and acquisitions and share sales, which means its servers could have confidential information about deals that have yet to be announced.

The firm also has a large litigation and restructuring practice, and private communication between the firm and its clients is also on its servers.

In a Thursday statement, McCarthy Tétrault said it caught the breach late on October 22 and that it quickly worked with a cybersecurity firm to determine the extent and scope of the unauthorized activity.

“The investigation has since identified that an unauthorized third party gained access to certain files, including information relating to clients,” the firm said in the statement.

McCarthy Tétrault confirmed it has been reaching out to clients this week and also said it has notified law enforcement and the relevant professional regulatory bodies and offered them its cooperation.

“We sincerely regret the concern this incident may have caused our clients, our people and the organizations we work with,” the firm said.