An alleged university cryptomining scheme from 2016–2019 has reached a new stage in U.S. federal proceedings. BleepingComputer reported on November 4 that two Canadians face charges over intrusions involving stolen credentials, malware and the misuse of academic computing resources.
The Justice Department’s November 3 announcement, updated November 4, names Ryan James Roach and Mathiew James Stubbings. Charges cover conspiracy, obtaining information from protected computers and intentional computer damage. Both defendants are presumed innocent unless proven guilty.
Roach was extradited from Canada on October 28 and arraigned in the United States. DOJ said extradition proceedings for Stubbings remained underway in Canada. This is a prosecution development concerning older alleged conduct, rather than disclosure of a newly discovered university breach.
Computing capacity was part of the alleged target
Prosecutors say the scheme targeted institutions with supercomputers in New York, Tennessee, North Carolina and Massachusetts. They allege the defendants used servers registered under false identities to distribute malware and hold stolen credentials, while using compromised systems to conceal activity and extend network access.
The announcement alleges damage to at least ten protected computers within a year and losses of at least $5,000. That figure is a stated lower bound, not a complete accounting of the cost to every affected institution. DOJ does not identify the universities or a specific exploited vulnerability.
Why a miner warrants a wider investigation
For university security teams, the useful question is what access made an unauthorised workload possible. The allegation combines processing-power abuse with credential theft and movement through a network. Removing an unexpected mining process would not, by itself, answer whether an account or another system remained exposed.
As practical context, an investigation should connect workload records with authentication events, endpoint findings and unusual outbound traffic. Administrators can then establish which identities and machines need further review before deciding on containment and recovery. These are general incident-response considerations, not evidence that any particular institution in this case missed those checks.
