Two Canadians indicted for hacking US universities to mine cryptocurrency
A federal grand jury has indicted Canadians Ryan James Roach and Mathiew James Stubbings for allegedly hacking multiple US universities and using the compromised systems, including supercomputers, to mine cryptocurrency. Each man faces up to 10 years in prison and a $250,000 fine if convicted.
BleepingComputer
A federal grand jury has indicted two Canadian nationals accused of breaching multiple US universities and using the compromised systems to mine cryptocurrency, according to the Department of Justice.
Ryan James Roach, 35, and Mathiew James Stubbings, 41, each face a maximum penalty of 10 years in prison and a $250,000 fine if found guilty of conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer.
According to court documents, the two men used virtual private servers registered under fake names in multiple countries between June 2016 and December 2019 to infect systems on the networks of unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts.
The Department of Justice said these servers transmitted malware and mining software to victim computers and stored stolen login credentials. Once inside the victims' networks, Roach and Stubbings allegedly stole data and credentials, deployed crypto-mining malware, and in some cases used compromised systems for vulnerability research after gaining access to supercomputers on the victims' networks.
"Roach and Stubbings targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities," the department said. It added that once inside a network, the defendants used sophisticated techniques and tools to conduct reconnaissance and expand their access.
Prosecutors also allege the pair damaged at least 10 computers over the course of one year, causing losses of at least $5,000.
Roach was extradited from Canada to the United States on October 28 and was arraigned ahead of a detention hearing on November 3. Stubbings will also be arraigned following his extradition from Canada.
The indictment follows a period in which multiple US universities disclosed breaches, including Ivy League institutions Harvard University, Princeton University, and the University of Pennsylvania. All three confirmed in November 2025 that attackers had accessed donors' information and other sensitive data.