Short answer: Two Canadians were charged for hacking US universities and using them for cryptocurrency mining. Universities and their donors' data were affected. Stay vigilant and use security tools.
TL;DR
- Canadians charged for hacking US universities
- Used systems for cryptocurrency mining
- Vulnerabilities in universities' networks exploited
- Caused damages to university computers
What happened?
A cybersecurity incident where two Canadians, Ryan Roach and Mathiew Stubbings, were charged for hacking into multiple US universities. They used these systems to mine cryptocurrency and stole data. They targeted universities in New York, Tennessee, North Carolina, and Massachusetts. The attack involved sophisticated methods to gain access and use virtual private servers to hide their identities. This incident highlights the risks to educational institutions and the importance of robust cybersecurity measures.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Malware
- Harmful software made to spy, steal or damage.
Key facts
| Reported by | BleepingComputer |
|---|---|
| Date reported | 04 Nov 2026 |
How it works
Two Canadians, Roach and Stubbings, used malware to hack into the networks of US universities. They researched security vulnerabilities and used compromised systems for crypto-mining.
- Set up virtual servers in multiple countries
- Infect university systems with malware
- Deploy crypto-mining software
- Conduct security research
Skillmate analyst mapping (our judgement, not from the vendor):
- T1566 Phishing
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-04 | Reported by BleepingComputer | BleepingComputer |
| 2026-11-09 | This Skillmate explainer published | Skillmate |
How to fix it
- If you have an account with the affected company, change that password and any reused copies of it.
- Turn on two-factor authentication (a second login step) wherever the service offers it.
- Expect phishing emails or calls that use the exposed details; verify requests through official channels.
How to detect it
Defenders should look for signs like unusual logins, system crashes, and logs of malware activity.
Signs to watch for:
- Login alerts from new devices or locations on the affected account.
- Password-reset emails you did not ask for.
- Phishing messages that quote your real account details.
What is confirmed
- Reported by BleepingComputer
Why it matters
It highlights the need for stronger cybersecurity measures in educational institutions and highlights the risks to user data and privacy.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What were the charges against Roach and Stubbings?
Roach and Stubbings were charged with conspiracy to obtain information from a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer.
How did Roach and Stubbings use virtual private servers?
They used virtual private servers registered under fake names to infect multiple US university networks with malware.
What kind of damage did Roach and Stubbings cause?
They damaged at least 10 computers, causing losses of at least $5,000 over one year.
Sources
- US charges two Canadians accused of hacking US universities (BleepingComputer)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.