A federal grand jury has brought charges against two Canadian nationals accused of breaching the networks of multiple US universities and leveraging those compromised systems for cryptocurrency mining operations.
Ryan James Roach, 35, and Mathiew James Stubbings, 41, each face up to 10 years in prison and fines of $250,000 if convicted. The charges include conspiracy to obtain information from protected computers and cause damage to protected computers, unauthorized access to protected computers, and intentional damage to protected computers.
Court filings indicate that between June 2016 and December 2019, the pair operated virtual private servers registered under false identities across multiple countries. They used these servers to distribute malware and mining software to educational institutions in New York, Tennessee, North Carolina, and Massachusetts.
The Department of Justice stated that "These servers transmitted malware and mining software to victim computers and stored stolen login credentials."
Once gaining entry to university networks, the defendants allegedly extracted sensitive data and authentication credentials, installed cryptocurrency-mining malware, and in certain instances accessed supercomputers to conduct vulnerability research.
Prosecutors noted that "Roach and Stubbings targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities." The DOJ further stated that "Once inside a network, Roach and Stubbings used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network."
Prosecutors allege the defendants damaged at least 10 computers over a one-year period, resulting in losses exceeding $5,000.
Roach was extradited to the United States from Canada on October 28 and appeared before a detention hearing on November 3. Stubbings is expected to be arraigned following his extradition from Canada.
The indictments come amid a broader pattern of breaches affecting US universities. In November 2025, three Ivy League institutions—Harvard University, Princeton University, and the University of Pennsylvania—each disclosed data breaches in which attackers obtained donor information and other confidential materials.