"These servers transmitted malware and mining software to victim computers and stored stolen login credentials," the Department of Justice (DOJ) said.
Federal indictment and charges against Ryan James Roach and Mathiew James Stubbings
A federal grand jury has indicted two Canadian nationals, 35‑year‑old Ryan James Roach and 41‑year‑old Mathiew James Stubbings, on criminal counts tied to an alleged campaign of intrusions against multiple U.S. universities. According to the indictment described in court documents, the pair face charges including conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer.
If convicted on the counts listed, each defendant faces a statutory maximum sentence of 10 years in prison and a $250,000 fine for the charged offenses.
Alleged operational methods: virtual private servers, fake names, and crypto‑mining malware
Prosecutors say Roach and Stubbings conducted their activity between June 2016 and December 2019 using virtual private servers (VPS) located in multiple countries. The indictment states those servers were registered under fake names and that they served several roles in the alleged campaign: transmitting malware and mining software to victim machines, and storing stolen login credentials.
Once inside victim networks, the two men are accused of deploying crypto‑mining malware and using compromised systems for other purposes, including vulnerability research after gaining access to supercomputers on the victims' networks. The DOJ also alleges the defendants used a combination of a server and compromised computers from another victim to conceal their identities while they moved through target networks.
The agency characterized the pair's activity as using "sophisticated techniques and tools to conduct reconnaissance and expand their access within the network."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTargets, scope, and measured damage
Court documents identify the victims as unnamed educational institutions with networks in New York, Tennessee, North Carolina, and Massachusetts. Prosecutors say the defendants stole data and login credentials from those networks and, in at least some cases, accessed supercomputers hosted by the affected institutions.
The indictment further alleges Roach and Stubbings damaged at least 10 computers over a one‑year period and that those actions caused aggregate losses of at least $5,000.
The filing sits alongside a larger contemporaneous pattern of higher‑education breaches: multiple U.S. universities disclosed data incidents over the last year, and the source notes that Harvard University, Princeton University, and the University of Pennsylvania each disclosed breaches in November 2025 in which attackers accessed donors' information and other sensitive data.
Extradition, arraignment, and immediate legal posture
Roach was extradited from Canada to the United States on October 28 and was arraigned before a detention hearing on November 3, according to the record. Stubbings remains in Canada and "will also be arraigned after his extradition from Canada," prosecutors said.
The indictment and extradition steps set in motion the U.S. criminal process: formal arraignment schedules, detention hearings, and the possibility of plea or trial proceedings, all of which will resolve whether the alleged conduct meets the elements of the charged federal offenses.
What this means for technologists, policymakers, and affected universities
- Technologists and security teams: Operations teams at research universities and institutions that host high‑performance computing resources will likely look to validate credential hygiene, segmentation of compute resources, and the integrity of systems exposed to remote access—areas the indictment highlights as avenues the defendants allegedly exploited.
- Policymakers and regulators: Legislators and regulators concerned with cross‑border cybercrime and extradition may view these developments as an example of criminal matters that involve cooperation with foreign authorities, given the reported extraditions from Canada.
- Affected universities and procurement leaders: Institutions that operate or procure supercomputing resources and shared research infrastructure will need to weigh access controls, incident response posture, and the documented risk that compromised academic systems can be used for secondary criminal purposes such as crypto‑mining and vulnerability research by outsiders.
The indictment paints a picture of persistent, cross‑border intrusion activity that combined commodity objectives—crypto‑mining and credential theft—with targeted research on high‑value computing assets. With one defendant already in U.S. custody and the other awaiting extradition, the coming weeks will test the evidence set forth in the grand jury filing and whether those facts prove the alleged patterns of compromise in court.
Source: BleepingComputer — US charges two Canadians accused of hacking US universities
