US prosecutors charge two Canadians with hacking university computers to mine crypto

A US federal grand jury has indicted two Canadian men, Ryan James Roach, 35, and Mathiew James Stubbings, 41, for allegedly hacking university computers in four states to mine cryptocurrency between June 2016 and December 2019.

The US Department of Justice says the pair targeted institutions with supercomputers in New York, Tennessee, North Carolina and Massachusetts, damaging at least 10 protected computers. Roach appeared before a judge on November 3. Stubbings remains in Canada and has not been extradited.

University computers targeted for cryptocurrency mining

The indictment alleges that Roach and Stubbings used private servers located in multiple countries to conceal their activities and gain unauthorised access to university networks.

Their targets reportedly included educational institutions with advanced computing systems capable of performing complex scientific and academic research. These systems offered substantial processing power, making them attractive targets for cryptocurrency mining operations.

According to prosecutors, the defendants used compromised servers and computers to facilitate their attacks, creating multiple layers between their actual identities and the targeted networks.

Once access was established, the alleged attackers deployed malware designed to steal authentication credentials, maintain control over compromised systems and extract information from the victims’ networks.

In some instances, mining software was installed directly on university computers, allowing the defendants to use institutional processing capacity to mine cryptocurrency without bearing the associated infrastructure and electricity costs.

The alleged scheme effectively turned university computers into unauthorised mining infrastructure, potentially diverting computing resources away from legitimate academic research and institutional operations.

The US Department of Justice described the targeting strategy in its statement:

“Roach and Stubbings targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities,” — US Department of Justice.

The use of compromised computers to conceal the attackers’ identities also suggests that the operation relied on more than straightforward password theft. Prosecutors allege that the suspects used multiple techniques to navigate networks, identify vulnerabilities and expand their access after gaining an initial foothold.

Malware, stolen credentials and years of unauthorised access

Beyond installing cryptocurrency-mining software, the alleged operation involved a broader set of cyber intrusion techniques.

The indictment states that the defendants used malware to obtain login credentials and establish control over compromised university systems. They also allegedly transferred data from victim networks to servers under their control.

This process, known as data exfiltration, involves moving information from a targeted system to an external location without authorisation. It can allow attackers to collect sensitive information, maintain access to compromised infrastructure or support further malicious activity.

Investigators also allege that Roach and Stubbings conducted reconnaissance after entering university networks. This involved examining the compromised systems to identify additional vulnerabilities and opportunities to expand their access.

The alleged intrusions affected protected computers between June 2016 and December 2019. Prosecutors say the defendants damaged at least 10 protected computers, with the resulting losses estimated at no less than $5,000.

Although the reported damage threshold is relatively modest compared with major ransomware incidents and large-scale data breaches, the case raises concerns about the misuse of high-performance computing infrastructure.

University supercomputers are often designed to support scientific modelling, engineering simulations, medical research and other computationally intensive activities. Unauthorised cryptocurrency mining can consume processing capacity, increase electricity costs and interfere with legitimate workloads.

The alleged use of compromised third-party computers and international servers also illustrates how cybercriminals can distribute their operations across different jurisdictions, making investigations and attribution more complicated.

US prosecution puts Canadian defendants at risk of prison

Roach and Stubbings are facing federal charges of conspiracy to obtain information from protected computers and conspiracy to cause intentional damage to those systems.

Roach appeared before a judge on Tuesday, November 3, 2026, following the indictment. Stubbings, meanwhile, remains in Canada and has yet to be extradited to the United States to face the charges.

If convicted, each defendant could face a maximum sentence of 10 years in prison and a fine of up to $250,000.

The prosecution comes amid continuing concerns about cybersecurity at American universities, which hold substantial amounts of sensitive personal, academic and institutional information.

Several prominent educational institutions have experienced cyber incidents in recent years. Columbia University, Princeton University and the University of Pennsylvania have previously been linked to breaches exposing information belonging to students, alumni and employees.

However, the latest case differs from conventional data breaches because the alleged objective was not primarily to obtain personal information for resale or use it in identity theft. Instead, the suspects allegedly sought to monetise the computing power of compromised university computers through cryptocurrency mining.