McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies have disclosed recent breaches, with damage contained and clients being alerted, ABA Journal reported on Nov. 2, 2026, and Law360 Canada reported on Nov. 3. A cybersecurity lawyer quoted in that coverage now warns clients could face liability if their personal information held by firms was compromised.
Law firms hold exactly what attackers want: deal documents, personal information and privileged strategy, concentrated in one place. The breach question therefore travels. It starts at the firm, and it lands on the desk of every client whose information the firm held.
Your supplier's breach becomes your board's question.
Expect the practical consequence next: clients will send harder supplier-security questionnaires to every professional-services firm they use, covering access controls, incident notification, retention and testing. Firms that can answer with evidence, not assurances, will keep trust. Preparing those answers belongs in cybersecurity readiness and managed care long before a questionnaire arrives with a deadline.
If your firm holds client information, draft your breach notification path and your questionnaire answers now, while you can still choose the wording calmly. After an incident, clients will judge the speed and clarity of your answer as much as the incident itself.