McCarthy Tétrault Breach: Who Can Grant Access to Your Law Firm’s Systems?

The question for law firm leadership: A convincing request for technical help can become a request for access to client information. The firm needs to know who can approve that request, what the resulting account or application can reach, and how quickly access can be stopped.

On October 29, 2026, McCarthy Tétrault publicly confirmed that it had identified a cybersecurity incident involving a coordinated social-engineering campaign on October 22. Its investigation found that an unauthorized third party had accessed certain files, including client-related information. The firm said it had contained the activity, begun contacting affected parties, notified law enforcement and professional regulators, and continued operating normally.

The incident raises a practical question for every Canadian law firm, including small practices: who can grant access to your systems, and who knows what that access allows? This is not only an IT problem. It involves staff judgment, administrator privileges, client-file permissions, outside support providers and the firm’s ability to respond.

What McCarthy Tétrault has confirmed

In its October 29 statement, McCarthy Tétrault said the incident was part of a coordinated social-engineering campaign. It identified unauthorized access to certain files containing client information. The firm also reported that its investigation had found no evidence of additional affected accounts, lateral movement, unauthorized account creation or persistence, and that its investigation remained ongoing.

What the statement does not establish: which individual action was taken, whether remote-control software was installed, whether an employee approved a particular permissions prompt, or precisely which authentication steps an attacker used. We should not mistake a general description of social engineering for a verified reconstruction of this firm’s incident.

The distinction matters. A useful lesson does not require inventing a technical failure or blaming an individual employee.

The current threat: someone claiming to be IT support

On October 28, one day before McCarthy Tétrault’s statement, the Canadian Centre for Cyber Security issued alert AL26-028. It warned of an active voice-phishing campaign against Canadian organizations, with October activity concentrated on the legal sector.

The Cyber Centre describes callers impersonating internal IT staff through telephone calls or Microsoft Teams. They may claim that a password, passkey or multifactor authentication setting urgently needs attention and direct the employee to a convincing fake sign-in page. In some reported campaigns, the fraudulent page relays credentials and MFA responses to obtain an authenticated session.

This is a documented industry-wide threat pattern, not a claim that McCarthy Tétrault was compromised through every step of that pattern.

A law firm can have antivirus, Microsoft 365, MFA and a reputable IT provider and still face a convincing request presented as normal support. The control that is often missing is an independent way to verify who is asking and whether the requested access is authorized.

Who can actually grant access to client information?

Access is not a single setting. In a smaller law office, it may be granted or exposed through several different paths:

• User sign-ins and active sessions: a compromised employee session may reach everything that user can legitimately read, download or share.
• SharePoint, OneDrive and Teams sharing: matter folders, broad group membership, guest access and links can expose more than the firm expects.
• Administrator and recovery privileges: an administrator or help-desk process may change MFA methods, reset credentials, create access or approve a device.
• Third-party applications and integrations: some software requests permission to access mail, files or other information. Consent and app permissions need deliberate oversight.
• Outside providers: IT companies, software vendors, temporary support staff and former contractors may retain privileges that the firm has never recently reviewed.

These are potential exposure paths, not findings about McCarthy Tétrault’s configuration.

The key distinction is the authority to approve access versus the technical ability to grant it. A receptionist, clerk, lawyer or administrator may receive an apparently credible support request. The firm should not expect that person to determine the caller’s identity or approve a new access route under pressure.

A practical access review for a small Canadian law firm

A firm does not need a large security department to begin. It needs an accurate picture of its own environment and explicit rules for unexpected requests.

Map access to sensitive matters. Identify where active and closed client files are stored: document-management software, Microsoft 365, email, SharePoint, OneDrive, Teams and specialized practice platforms. For each location, record who owns it, who administers it, which users and outside parties can access it, and how access is reviewed.

Define who approves changes. Name the person authorized to approve new users, permissions, external sharing, guest access, remote support sessions, administrator changes and MFA resets. Make it clear that receiving a request does not automatically confer approval authority.

Use a trusted call-back process. An unexpected IT request should be verified through a known telephone number or an existing service channel, not the number, link or Teams invitation supplied by the requester. Staff need permission to stop the interaction without worrying that they are slowing down an urgent task.

Restrict unnecessary rights. Remove obsolete accounts and guest access, avoid broad permissions to sensitive matter folders, limit privileged administrators, and review applications with access to mail and files. A smaller permission footprint can reduce the damage a compromised session can cause.

Use phishing-resistant authentication where possible. The Cyber Centre recommends FIDO2 security keys or device-bound passkeys, particularly for privileged and higher-risk users. Ordinary MFA remains important, but not every MFA method resists real-time phishing or session theft. Verify what your Microsoft 365 plan actually supports before promising a particular control.

Monitor and keep evidence. Review suspicious sign-ins, new MFA methods, unusual mass file access, new application permissions and changed sharing arrangements. Ensure someone receives and acts on meaningful alerts. Keep suitable logs available for investigation, subject to the firm’s systems and licensing.

Prepare an escalation route. Staff should know precisely who to contact if they approved an unexpected prompt, opened a suspicious link or gave access to an unfamiliar person. Prompt reporting is more useful than blame.

What should happen when a suspicious request is reported?

If a staff member reports an unexpected IT call or sign-in request, the firm should contact its authorized technical administrator through a trusted channel and preserve the details. For a suspected account compromise, appropriate technical actions may include revoking active sessions, resetting credentials, removing unauthorized authentication methods, reviewing new app permissions and investigating mailbox and file activity.

The response must consider client confidentiality, preservation of evidence, applicable notification duties and the possibility that a threat actor accessed information without interrupting ordinary operations. The firm’s legal and professional advisers should determine applicable obligations; technical containment alone does not settle those questions.

Why backups and antivirus are not enough

A backup may help recover lost or deleted information. Endpoint protection can help identify malicious files or device activity. Neither, on its own, decides which person is authorized to approve remote access or how widely an authenticated user can see client material.

A firm also needs continuity: a business-controlled Microsoft 365 tenant, trusted provider contacts, alternate administrators, documented recovery authority and an agreed way to keep priority client work moving during a security investigation.

That is why access governance and business continuity belong in the same conversation, even when there is no ransomware, outage or visibly infected computer.

What CyberTECT helps smaller law firms review

CyberTECT works with smaller Ontario law firms to make the relationships among accounts, access, cloud systems, outside providers and client information understandable and manageable. The goal is to identify gaps that can be acted on, without pretending that another software licence resolves every responsibility.

Start with CyberTECT’s Law Firms digital-risk and continuity page to see how we approach account ownership, vendor access and operational dependencies. Our Digital Operations Checkup provides a focused starting review; Cybersecurity & Staff Readiness addresses practical safeguards and reporting processes. For firms looking at cloud administration and everyday protection, see Cloud IT for Canadian businesses.

Law firms should also review Microsoft Copilot and Law Firm Client Files for a related question: whether existing Microsoft 365 permissions and sharing are already broader than management realizes.

A useful first question for your next staff meeting: If somebody claims to be your IT provider tomorrow and asks a lawyer or clerk to approve access, how will that person verify the request, who is authorized to approve it, and what client material could the resulting access reach?

Frequently asked questions

Was the McCarthy Tétrault breach caused by an employee granting remote access?

McCarthy Tétrault confirmed a coordinated social-engineering incident and unauthorized access to certain files. Its October 29 statement does not publicly establish the exact action or mechanism that enabled access, so it would be inaccurate to present a specific employee action as confirmed.

Can an attacker reach law firm files even when MFA is enabled?

Yes. The Canadian Centre for Cyber Security describes active campaigns that use convincing fake sign-in pages and real-time relays to obtain sessions despite conventional MFA. Phishing-resistant authentication, independent verification and tighter permissions help reduce this risk.

What should a small law firm check first?

Identify who can authorize IT support and access changes, review Microsoft 365 and practice-platform administrators, inspect broad client-file sharing, verify outside-provider access and ensure that staff know a trusted route to report suspicious requests.

Is this only a risk for large law firms?

No. The same sign-in, cloud sharing, outside IT support and client-confidentiality dependencies exist in small practices. The scope of controls should reflect the firm’s size and systems, but the need to verify access requests applies regardless of headcount.

Primary sources and guidance

• McCarthy Tétrault: Statement from McCarthy Tétrault, October 29, 2026
• Canadian Centre for Cyber Security: AL26-028, Ongoing Help Desk Voice Phishing Campaign, October 28, 2026
• Law Society of Ontario: Using Technology
• Canadian Centre for Cyber Security: Secure your accounts and devices with multifactor authentication

Published October 30, 2026. This article is general operational cybersecurity guidance based on information available at publication. The McCarthy Tétrault investigation was ongoing at the time. CyberTECT does not provide legal advice or determine professional-conduct, privilege, privacy or breach-notification obligations.