Our weekly review covers 26 October to 1 November. One change: it now comes out on Monday, to open the week rather than close it. The principle stays the same: the week's key facts, read by a risk owner rather than an analyst, and what each one changes for a Canadian organization.
The week's thread fits in one uncomfortable sentence: the multifactor authentication most organizations have deployed does not survive a well-run phone call. Four of the country's most prestigious law firms learned it within a few days. This is not a story about naive employees. It is a story about controls chosen to tick a box, facing attackers who have learned to get around them.
Part 1: four firms, one call
What happened
Between 19 and 23 October, callers posing as the IT department reached employees at major Canadian firms: an urgent update, an expired password, a "passkey migration". The calls came through Microsoft Teams or from the help desk's number, sometimes spoofed. The employee was sent to a fake sign-in page that relayed their password and their MFA code in real time. The attacker was signed in before the employee hung up.
- Bennett Jones: two administrative staff accounts compromised on 19 October; revenue reports by client and, for some clients, descriptions of mandates exposed; document management and accounting systems not affected. The firm links it to "a broader campaign targeting Canadian law firms". Status: confirmed by the firm.
- McCarthy Tétrault: incident detected late on 22 October, a "coordinated social engineering campaign"; files, including client information, were accessed; according to the investigation, no lateral movement and no persistent access. Status: confirmed by the firm. The Globe and Mail reports four accounts compromised and, according to one source, 31,000 files stolen; that figure is not confirmed by the firm.
- Borden Ladner Gervais: access to part of its Microsoft cloud environment, client files accessed, Mandiant engaged. Status: confirmed by the firm.
- Davies Ward Phillips & Vineberg: one account compromised on 23 October, according to The Globe and Mail. Status: reported.
Stikeman Elliott was targeted but not breached, according to its chair quoted by The Globe and Mail. In total, at least seven accounts gave way across four firms (reported).
What the Canadian Centre for Cyber Security says
On 28 October, the Cyber Centre published alert AL26-028: an ongoing help desk voice phishing campaign targeting Canadian organizations since January, finance and law more heavily since July, and the legal sector first in October. Once in, the attackers add their own authentication method, delete security alerts, pull data from SharePoint and OneDrive, then demand a ransom. On 27 October, the RCMP's National Cybercrime Coordination Centre had flagged the same threat to law firms. Status: confirmed. No group is publicly named; the alert points to Google reports on fake help desk operations, which remains a suspicion, not an attribution.
What it changes
Three comfortable beliefs fell the same week.
"We have MFA, we're protected." A text message code, a push to approve or a six-digit code can all be relayed in real time through a fake page. Only phishing-resistant methods (FIDO2 security keys, device-bound passkeys) refuse to authenticate on a fake site. It is the Cyber Centre's first recommendation, and CISA has said the same since 2022.
"Our people are trained." The targeted firms are among the best equipped in the country. A call that comes through Teams, from the IT department's number, about a boring task, looks like nothing an annual training module shows. We wrote it after Abbott: one phone call is enough when the reset process trusts a voice.
"This only hits the big ones." What gave way was a process, not a budget. According to The Logic, LAWPRO, the insurer of Ontario lawyers, already sees smaller firms lose millions in fraudulent withdrawals, and plans to raise premiums in 2027 (reported).
For an executive team, the question is not "would our people fall for it?". Some will. It is: if an account gives way tomorrow, what does the attacker take before anyone notices?
Part 2: active exploitation
CISA added nine exploited flaws to its KEV catalogue between 26 and 30 October. Three hit exposed equipment directly:
- Ivanti Connect Secure, two flaws on 30 October (missing authentication, predictable credentials), one of them due today, 2 November. They follow the zero-day chain added on 13 October. Status: confirmed by CISA.
- Cisco Secure Firewall ASA and FTD, on 29 October: a denial of service that reboots the firewall. Status: confirmed.
- VMware ESX, on 28 October, attributed to a China-linked actor (suspected).
The week's other big story says the same thing by another route: on 29 October, about US$6.3 billion was stolen from Binance in some twenty minutes, the largest crypto theft on record. Analytics firms TRM Labs and Chainalysis attribute it to North Korea; Binance attributes nothing for now. The likely way in: an engineer's laptop (reported).
What it changes: an unpatched edge device and a compromised employee account lead to the same place. The register should name both doors, and an owner for each.
Part 3: Canada
Beyond the law firms, two Canadian claims this week: Akira says it took about 5 GB from Service One Transportation (logistics), and Genesis claims Psychometrics Canada, on 30 October. Status: claimed; Genesis claims have been fabricated before.
What it changes: law firms hold other people's secrets (unannounced deals, litigation, tax and health files). If your organization has an open mandate with one of them, the incident is yours too: it is a critical vendor and belongs as one in your third-party register. Stikeman Elliott's chair told The Globe and Mail the first step is being "completely transparent" with clients. Have you asked your firms what they hold about you, and how they would tell you?
Part 4: AI on both sides of the table
On 26 October the Cyber Centre updated a bulletin on agentic AI accelerating cyber attacks: agents chain the steps of an attack with less human direction; humans still pick the targets; basic measures still work, but every weakness is paid for faster. It cites a campaign where less than three hours separated choosing the target from privileged cloud access. Status: confirmed.
On the other side, Cohere, the Canadian AI model company, documented a popular open-weight model that tried to upload a file to cloud storage abroad without being asked (reported by Cohere).
What it changes: the voice phishing in Part 1 still needs humans on the phone. Synthetic voices and agents that research the target cut that cost every month. A control that relies on the employee's vigilance will be less and less enough; a control that technically refuses to authenticate on a fake site still holds.
The week's three questions for an executive committee
- What share of our accounts, starting with executives, finance and administrators, uses a phishing-resistant authentication method, and what is the target date for the rest?
- How does our help desk verify someone who asks for a password or MFA reset, and could a caller pass that check with what they find on LinkedIn?
- Which vendors hold our most sensitive documents (law firms, accountants, advisers), and what does each contract say about notification time?
Your turn
Our position: MFA by code or push has become a minimum, no longer a protection. Too harsh? Tell us in the comments what your organization has put in place, and what still stands in the way.
To see what an attacker sees of you before they pick up the phone, the free exposure report shows it within 48 hours. And thirty minutes with an expert is enough to work through your three questions.
Sources: Canadian Centre for Cyber Security, alert AL26-028 (28 Oct. 2026) · Canadian Centre for Cyber Security, bulletin on agentic AI · McCarthy Tétrault, statement of 29 Oct. · Bennett Jones, notice · BLG, statement · Nova Scotia Barristers' Society, RCMP alert (27 Oct.) · CISA, KEV catalogue · CISA, Implementing Phishing-Resistant MFA. Monitoring, named in the text: The Globe and Mail (30 Oct.), The Logic (29 Oct.), TRM Labs, Chainalysis, Cohere, ransomware.live.