Bennett Jones hit in data breach targeting Bay Street law firms

Bennett Jones LLP has confirmed it was compromised by a data breach, making it the third victim so far of a broader campaign targeting Bay Street law firms to gain access to files.

The firm said two of its business services employees’ user accounts were compromised on Oct. 19 as part of what it called a “larger campaign targeting Canadian law firms.”

McCarthy Tétrault LLP and Davies Ward Phillips & Vineberg LLP are also dealing with data breaches that have compromised thousands of files in total, including client information, The Globe reported on Thursday.

The Canadian Centre for Cyber Security on Wednesday cautioned that multiple Canadian firms have been targeted by cybercriminals impersonating internal IT support and directing employees to fraudulent sign-in pages.

The Globe previously reported that at least some of the breaches at law firms involved hackers using Microsoft Teams and posing as internal IT employees to request access to an employee’s computer.

Bennett Jones said the information stolen includes revenue reports from clients and, in some cases, general descriptions of the firm’s mandates for those clients.

However, the firm’s document management system, where legal files are contained, and its accounting system was not breached, Bennett Jones said in a notice on its website.

“We immediately detected the activity and took steps to contain, investigate and assess the affected data in scope,” the firm said in the statement, adding that it will contact clients impacted as it identifies them.