Federal prosecutors have exposed an international cybercrime operation in which two Canadian nationals allegedly infiltrated American universities, stole sensitive computer credentials, and secretly hijacked powerful supercomputers to generate cryptocurrency for their own financial benefit.

The investigation has resulted in federal criminal charges against two men, with one already extradited to the United States and the other facing ongoing extradition proceedings in Canada.

According to the U.S. Department of Justice, the alleged operation stretched across several years and targeted educational institutions in at least four American states.

The case raises serious questions about the security of America’s university research infrastructure and how sophisticated criminals can exploit expensive computing systems without authorization.

TWO CANADIANS FACE FEDERAL CHARGES

Federal prosecutors in Rochester, New York, announced the charges against 35-year-old Ryan James Roach of Saskatchewan, Canada, and 41-year-old Mathiew James Stubbings of Ontario, Canada.

The defendants are accused of participating in a conspiracy to gain unauthorized access to protected computers, steal information, and intentionally damage computer systems.

Investigators allege that the operation ran from June 2016 through December 2019.

During that period, the defendants allegedly compromised university computer networks in New York, Tennessee, North Carolina, and Massachusetts.

Federal authorities say the suspects specifically sought institutions operating powerful supercomputers, machines ordinarily used for scientific research, complex calculations, and advanced academic projects.

Rather than using those systems for their intended purposes, the suspects allegedly redirected computing power toward cryptocurrency mining.

The Justice Department announced the case on November 3, 2026.

HOW THE ALLEGED HACKING OPERATION WORKED

According to federal prosecutors, the operation relied on a sophisticated network of privately controlled servers operating across multiple countries.

The suspects allegedly registered those servers under false identities to conceal their involvement.

Investigators say the servers were used to distribute malicious software, collect stolen login credentials, and coordinate unauthorized access to university computers.

Once inside a university network, the defendants allegedly conducted additional reconnaissance to identify weaknesses and expand their control.

They also reportedly used computers compromised during earlier intrusions to conceal the origins of subsequent attacks.

This technique can make cybercrime investigations considerably more difficult because malicious activity may appear to originate from an innocent institution rather than the actual perpetrators.

The stolen credentials allegedly provided access to additional systems, allowing the operation to continue moving through targeted networks.

Federal investigators say the defendants ultimately installed cryptocurrency mining software that forced university computers to perform calculations benefiting the suspects.

AMERICAN SUPERCOMPUTERS ALLEGEDLY TURNED INTO CRYPTOCURRENCY MACHINES

One of the most disturbing aspects of the allegations involves the unauthorized use of university supercomputers.

These powerful machines represent significant investments in scientific research and technological development.

They are frequently used to perform advanced calculations that ordinary computers cannot efficiently complete.

According to court filings, at least one university supercomputer was allegedly redirected to mine cryptocurrency, leaving much of its processing capacity unavailable for legitimate users.

Canadian court records also identify Electroneum as one of the cryptocurrencies allegedly mined through the operation.

The financial consequences went beyond the cryptocurrency itself.

When criminals commandeer computing infrastructure, legitimate users can lose access to processing power while institutions continue paying for electricity, maintenance, security, and repairs.

In this case, Canadian court documents describe approximately $337,000 in alleged damages associated with one New York educational institution.

Those costs reportedly included shutting down affected systems, conducting forensic investigations, and rebuilding compromised infrastructure.

The broader financial impact across all targeted institutions has not been fully established publicly.

FBI INVESTIGATION TRACES THE DIGITAL TRAIL

The Federal Bureau of Investigation led the investigation into the alleged cybercrime operation.

According to court records reported in Canada, investigators examined internet addresses, server records, email accounts, and hosting information to connect the alleged activity to the suspects.

The investigation demonstrates how cybercriminals can attempt to conceal their identities by routing activity through multiple countries and compromised computer systems.

Despite those efforts, federal investigators say they identified evidence connecting the defendants to the operation.

The Justice Department’s Office of International Affairs assisted with the extradition process.

Roach was extradited from Canada to the United States on October 28, 2026.

He subsequently appeared before a federal magistrate judge in Rochester, New York.

Roach has pleaded not guilty.

Extradition proceedings involving Stubbings remain underway in Canada.

POSSIBLE PRISON SENTENCES

Both defendants face serious federal criminal charges.

The allegations include conspiracy to obtain information from protected computers and cause damage, obtaining protected computer information, and intentionally damaging protected systems.

The charged offenses carry maximum statutory penalties that include imprisonment and substantial financial fines.

Federal prosecutors have identified potential penalties of up to 10 years in prison and $250,000 in fines.

The ultimate punishment, if either defendant is convicted, would depend on the applicable charges, sentencing guidelines, and judicial findings.

The indictment alleges that the defendants damaged at least 10 protected computers within a one-year period, resulting in losses exceeding $5,000.

An indictment is an accusation, and both defendants are presumed innocent unless proven guilty.

WHY AMERICAN UNIVERSITIES ARE ATTRACTIVE TARGETS

American universities maintain extensive computer networks supporting research, education, administration, and scientific development.

Some institutions operate extraordinarily powerful computing systems capable of processing enormous amounts of information.

That computing power can also attract cybercriminals looking for financial gain.

Unlike traditional financial theft, cryptocurrency mining attacks do not necessarily require criminals to transfer money directly from a victim’s bank account.

Instead, attackers secretly use the victim’s computing resources to generate digital assets.

The institution absorbs the associated operating costs while the criminal receives the potential financial benefit.

Universities also face the challenge of protecting networks used by thousands of students, faculty members, researchers, contractors, and outside collaborators.

The combination of valuable computing infrastructure and complex access requirements creates substantial cybersecurity challenges.

A WARNING ABOUT AMERICA’S DIGITAL INFRASTRUCTURE

The allegations highlight a broader concern about the protection of American technological resources.

University supercomputers are valuable tools for scientific discovery and research. Unauthorized access can interrupt legitimate projects, compromise stored information, and create expensive recovery operations.

The case also demonstrates that cybercriminal activity can cross international borders while exploiting infrastructure located entirely within the United States.

Although the alleged intrusions occurred between 2016 and 2019, the federal prosecution is advancing in 2026 following years of investigation and international legal proceedings.

For American institutions investing heavily in advanced computing, the case serves as a warning that expensive technological infrastructure requires equally serious security protections.

The FBI investigation and extradition proceedings also demonstrate the importance of international cooperation in prosecuting cybercrime.

With one defendant now facing federal court proceedings in New York and another awaiting possible extradition, the case remains active.

The central allegation is straightforward but significant: powerful American university computers were allegedly turned into unauthorized cryptocurrency mining machines, allowing foreign suspects to exploit resources intended for education and scientific research.

The outcome will now depend on the evidence presented in federal court.