Statement from McCarthy Tétrault

Late on October 22, McCarthy Tétrault identified a cybersecurity incident involving a coordinated social engineering campaign to gain unauthorized access to its systems.

Working with a leading cybersecurity firm, we immediately took steps to determine the extent and scope of the unauthorized activity, contain it, and secure the accounts. The investigation has identified no evidence of additional affected accounts, lateral movement, unauthorized account creation, or persistence.

The investigation has since identified that an unauthorized third party gained access to certain files, including information relating to clients. On October 25, we reached out to such affected parties. As we identify information that requires additional communications, we will contact those parties directly. We have also notified law enforcement and the relevant professional regulatory bodies and offered them our cooperation.

The investigation is ongoing, and the firm continues to operate normally.

We sincerely regret the concern this incident may have caused our clients, our people and the organizations we work with.

Media contact: Mathieu Rompré, Senior Director, Communications, media@mccarthy.ca.

Additional information: Canadian Centre for Cyber Security alert regarding vishing campaign targeting multiple Canadian firms in the legal and financial sectors