A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency.

35-year-old Ryan James Roach and 41-year-old Mathiew James Stubbings now face a maximum penalty of 10 years in prison and a $250,000 fine each if found guilty of conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer.

According to court documents, the two accomplices used virtual private servers in multiple countries (registered under fake names) between June 2016 and December 2019 to infect systems on the networks of multiple unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts with malware.

"These servers transmitted malware and mining software to victim computers and stored stolen login credentials," the Department of Justice (DOJ) said.

Once inside the victims' networks, Roach and Stubbings allegedly stole data and login credentials, deployed crypto-mining malware, and, in some cases, used compromised systems for vulnerability research after gaining access to supercomputers on the victims' networks.

"Roach and Stubbings targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities," the DOJ added,

"Once inside a network, Roach and Stubbings used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network."

According to prosecutors, the two defendants also damaged at least 10 computers over one year, causing losses of at least $5,000.

Roach was extradited from Canada to the United States on October 28 and was arraigned before a detention hearing on November 3. Stubbings will also be arraigned after his extradition from Canada.

Multiple US universities have been breached over the last year, including Ivy League schools Harvard University, Princeton University, and the University of Pennsylvania. All disclosed data breaches in November 2025, confirming that attackers accessed donors' information and other sensitive data.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.