In late October 2026, attackers phoned employees at some of Canada's largest law firms and said they were from the firm's IT department. They described an expired password or a critical software update, then sent each employee to a fake sign-in page. At least 4 firms were breached: McCarthy Tétrault, Davies, Bennett Jones, and Borden Ladner Gervais. At least 7 employees gave the attackers access, and many of the calls came through Microsoft Teams or appeared to come from the IT department's own number (Source: The Globe and Mail).
The law firms are the story in the news. The method used against them applies to any organization whose employees use Teams, Slack, or another chat tool and have an IT help desk to call.
What happened at the 4 firms
McCarthy Tétrault discovered the breach on October 22 and notified clients on October 25, describing a "co-ordinated social engineering campaign" (Source: The Logic). Across the firms, 4 employee accounts were compromised at McCarthy Tétrault, 2 at Bennett Jones, and 1 at Davies (Source: The Globe and Mail). A source told The Globe and Mail that 31,000 of McCarthy Tétrault's files were stolen (Source: The Logic).
The fake sign-in pages were able to get around multi-factor authentication, the extra approval step at login (Source: The Globe and Mail). The web addresses used the firm's own name combined with other words, so a quick look at the link looked right (Source: LIANS, via the Nova Scotia Barristers' Society). The RCMP's National Cybercrime Coordination Centre has since warned law firms, and Law360 reports the government has alerted the legal and financial sectors to an ongoing campaign. LAWPRO, the insurer for Ontario law firms, says recent attacks on firms have led to unauthorized withdrawals totalling millions of dollars (Source: The Logic).
Organizations that hold large amounts of personal data are the target
A law firm's files include passports, tax and financial records, health records, and private communications between clients and their lawyers (Source: The Globe and Mail). One successful login gives an attacker access to a great deal of that information.
The government alert names the legal and financial sectors. The Cybersecurity Canada Report 2026 ranks healthcare and life sciences, financial services, professional services, and technology and software as the top targeted sectors in Canada, and puts the average financial services breach at CA$9.97M (Source: Cybersecurity Canada Report 2026). The organizations below hold the same kinds of data, so the same method applies to them:
-
Law firms and immigration consultants
-
Accounting and tax firms
-
Banks, wealth managers, and financial advisors
-
Healthcare providers and clinics
-
Insurance brokers
-
Mortgage and real estate brokerages
-
HR and payroll providers
-
Construction and transportation companies
-
Colleges and universities
The impersonation works inside the tools employees use every day
Microsoft has documented a technique it calls cross-tenant helpdesk impersonation. An attacker messages employees from an outside Teams account with a name like "Help Desk," then asks them to grant access or run software. Because the contact happens inside a collaboration tool instead of email, it can bypass the skepticism people have toward unsolicited email (Source: Microsoft Security Blog, September 2026).
Palo Alto Networks' Unit 42 tracked a campaign called Spring Ring between January and April 2026 that reached more than 150 employees at 10 or more companies. It used Teams' default setting, which allows chats from users outside an organization (Source: Unit 42, as reported by SecureWorld). Reporting on the law firms has not described how their Teams calls were set up. The pattern matches.
The method applies to any chat tool, because it depends on employees treating a message that looks internal as safe. Unit 42 says attackers now move between email, Teams, Slack, text messages, phone calls, and remote-access tools, and that each interaction makes the next one feel more credible (Source: Unit 42, as reported by SecureWorld).
Every channel needs the same attention, and training has to keep up
An employee who has learned to question an unexpected email may answer a chat message or a phone call from "IT" without a second thought. Attackers change channels and wording from one campaign to the next, so awareness training has to be refreshed as often as the campaigns change, and it has to cover chat and phone calls as well as email. Guidance published after the Spring Ring campaign recommends including collaboration platforms in both phishing awareness and security monitoring (Source: Security Boulevard).
Questions to ask about your own environment
Your answers to these questions show where your organization is exposed:
-
Who outside your organization can message and call your employees in Teams, Slack, or your other chat tools?
-
What does an outside account look like to an employee, and would they notice it?
-
If an employee entered their login on a fake page today, what would your systems show, and who would see it?
-
Does your training cover chat messages and phone calls, or only email?
-
Does anyone review chat and sign-in activity outside business hours?
-
If your IT team called an employee tomorrow, how would the employee know it was really them?
Concerned about Teams and other chat entry points? We have it covered
If your answer to any of those questions was "not sure," that is what we are here for. Quick Intelligence manages security and IT as one team, and our SOC is 100% Canadian operated and watches your environment 24 hours a day. We cover chat entry points like Teams, and a Qi Proof session is a consultation with a Quick Intelligence security advisor.
Unlock a Qi Proof Session to book your consultation and choose a Quick Look (15 minutes), a Working Session (30 minutes), or a Deep Dive (60 minutes). Your advisor will evaluate your environment with you at no cost, and you do not need to prepare anything.
Frequently asked questions
What is vishing?
Vishing is voice phishing. An attacker phones an employee, or calls through a chat tool such as Teams, and impersonates someone trusted, like the IT help desk, to get a login or access to a device.
How were the Canadian law firms breached?
Attackers posed as each firm's IT department by phone and Microsoft Teams and sent employees to fake sign-in pages that could get around multi-factor authentication. At least 4 firms and 7 employees were affected (Source: The Globe and Mail).
Which organizations are at risk of the same method?
Any organization whose employees use a chat tool and an IT help desk can be targeted. Organizations that hold large amounts of personal data, such as legal, financial, healthcare, accounting, insurance, and payroll providers, have a great deal to lose from one successful login.
Does this only affect Microsoft Teams?
The documented campaigns use Teams, and Unit 42 reports that attackers also move through Slack, text messages, and phone calls. The method relies on employees trusting messages that look internal, so any chat tool deserves the same attention.
How can I find out whether my chat tools are exposed?
A security advisor can evaluate how your chat tools and sign-in activity are set up and what your team would see during an attack. A Qi Proof session is a consultation with a Quick Intelligence security advisor, at no cost.
