The RCMP’s National Cybercrime Coordination Centre (NC3) has identified a cyber threat targeting Canadian law firms.

Cybercriminals are contacting lawyers or law firm employees by phone and posing as the firm’s IT helpdesk. The callers claim an urgent security change is required and will direct the employee to a fraudulent login page that is made to look like it is a legitimate firm page. When an employee enters their username and password on this fraudulent login page, they are giving these credentials to the cybercriminals. The cybercriminals will then use those credentials to breach law firm systems.

The spoofed domains for these login pages will incorporate a law firm’s name or a variation of it, together with other words. Examples include:

• LawFirmName dot configuremysso dot com
• LawFirmName dot myaccountoptions dot com
• LawFirmName dot myaccountsetup dot com
• LawFirmName dot addsecureapps dot com

Be alert and aware of these social engineering scenarios. Do not assume a caller is from your IT department simply because they know information about you or your firm or that the web address provided by the caller includes your firm’s name. The callers will sound legitimate and be persistent.

KEY NEXT STEPS

Alert staff: Staff are likely to be the targets for these calls, which can also start as emails. Make sure everyone at your firm is aware of these scenarios and knows that cybercriminals may impersonate internal IT personnel.

Stop and verify: If you receive an unexpected call or message from someone claiming to be from your firm’s IT department, end the communication. Contact your IT department using a known and trusted phone number or other established internal method.

Report: If you believe your credentials have been compromised, please contact your IT department immediately, your cyber insurer at cyberclaims@clia.ca /phone 1-833-383-1488 or contact Janice Ringrose, Insurance & Risk Manager, at insurance@lsnl.ca

Cybercrime and fraud can also be reported to the RCMP and Canadian Anti-Fraud Centre through the National Cybercrime and Fraud Reporting System.

Posted: 27 October 2026