Two Canadian men have been indicted by a federal grand jury on charges that they hacked several US universities and mined cryptocurrency on the compromised systems. Ryan James Roach, 35, and Mathiew James Stubbings, 41, are accused of conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. Each faces up to 10 years in prison and a $250,000 fine if convicted.
Prosecutors say the pair operated between June 2016 and December 2019, using virtual private servers registered under fake names in multiple countries. According to the Department of Justice, those servers delivered malware and mining software to victim computers and stored stolen login credentials. The targets were unnamed educational institutions in New York, Tennessee, North Carolina and Massachusetts.
After gaining entry to the universities' networks, Roach and Stubbings allegedly stole data and credentials and deployed cryptocurrency-mining malware. In some cases, the DOJ said, they used the compromised systems for vulnerability research once they had accessed supercomputers on the victims' networks.
The DOJ said the two men sought out US educational institutions that had supercomputers and researched security holes in the victim networks. Their methods for gaining access included using a server and computers compromised at another victim to hide their identities, according to the department. Once inside, prosecutors say, they used sophisticated techniques and tools to conduct reconnaissance and widen their access within the network.
Prosecutors also allege the defendants damaged at least 10 computers over the course of a year, causing losses of at least $5,000.
Roach was extradited from Canada to the United States on October 28 and was arraigned before a detention hearing on November 3. Stubbings is also expected to be arraigned following his extradition from Canada.
The charges arrive as US universities continue to report intrusions. Harvard University, Princeton University and the University of Pennsylvania, all Ivy League schools, disclosed data breaches in November 2025, confirming that attackers had accessed donors' information and other sensitive data. The indictment does not link the two Canadians to those disclosed breaches.
More cybersecurity news from TechManNews.
