Be alert: Cybercriminals pose as law firm IT staff

Please share this notice immediately with all employees.

Cybercriminals in Ontario are targeting lawyers and law firm employees by phone, impersonating the firm’s IT helpdesk.

The fraudulent callers claim that an urgent security change is needed and direct employees to a fake login page that mimics the firm’s legitimate login page. When employees enter their username and password, they unknowingly give their login credentials to cybercriminals. The cybercriminals then gain immediate access to the firm’s systems and commit further cybercrimes, such as conducting ransomware, stealing confidential data, and initiating funds transfer frauds. Here are more details of this cybercrime.

What can you do?

1. Alert staff immediately. Have a firm meeting and ensure that every employee is aware of this fraud and share this notice with every firm employee.
2. Stop and verify. If you receive a call or message from someone claiming to be in your IT department immediately end the call. Contact your IT department directly at a trusted phone number.
3. Make it standard practice for employees to independently verify all urgent IT requests.