For more than three years, computers at several American universities were allegedly doing work their owners never asked for. According to a federal indictment, two Canadian men broke into campus networks, stole passwords and quietly used the machines to mine cryptocurrency for themselves. One of them is now in the United States to face charges in the university supercomputer hacking case. The other is still fighting extradition in Canada.
U.S. Attorney Michael DiGiacomo announced that a federal grand jury has indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario. Both face charges of conspiracy to obtain information from and cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer. The charges carry a maximum penalty of 10 years in prison and a $250,000 fine.
Why the University Supercomputer Hacking Targeted Campuses
The indictment points to a clear reason for the choice of targets. Roach and Stubbings allegedly went after educational institutions in the United States that had supercomputers.
The scheme relied on processing power. Once inside, the pair allegedly forced victim computers to run cryptocurrency mining software, putting the machines’ computing power to work for their own financial gain. Machines built for heavy computation made the scheme more profitable.
Victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Some of the damaged computers belonged to a higher education institution in the Western District of New York, where the case is being prosecuted.
How the Alleged Scheme Worked
According to the indictment, the scheme ran from June 2016 to December 2019 and followed a set pattern.
The pair allegedly researched security weaknesses in victim networks before getting in. They accessed computers without authorization and deployed malware to take control. They then stole login credentials and sent the data to servers they controlled.
Once inside a network, they allegedly used sophisticated techniques and tools to carry out reconnaissance and expand their access. The stolen login credentials were stored on their servers, the same servers that sent out malware and mining software to victim machines.
The indictment says Roach and Stubbings damaged 10 or more protected computers within a one-year period, causing a loss of at least $5,000.
How They Allegedly Stayed Hidden
The case also shows the effort the pair allegedly put into avoiding detection.
They used virtual private servers in multiple countries, registered under false names. Those servers delivered malware and mining software to victim computers and held the stolen credentials.
To conceal their identities further, they allegedly used a server and compromised computers belonging to one victim to gain access to another. That meant intrusions could appear to come from a victim’s own systems instead of from the people behind them.
Where the University Supercomputer Hacking Case Stands
Roach was extradited from Canada to the United States on October 28. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing on November 3. Extradition proceedings for Stubbings are continuing in Canada.
The investigation was carried out by the Federal Bureau of Investigation, under the direction of Special Agent-in-Charge Allen D. Davis II, and the Department of Justice’s Computer Crime and Intellectual Property Section. The Justice Department’s Office of International Affairs helped secure Roach’s arrest and extradition. Assistant U.S. Attorney Meghan K. McGuire is prosecuting the case.
What Is Still Unclear
The indictment leaves several details open. It does not say how much cryptocurrency the pair allegedly mined, how many institutions were affected in total, or which universities were targeted beyond their states. The loss figure stated in the charges, at least $5,000, is the legal threshold tied to the damage count, not a full estimate of the harm.
An indictment is an accusation, not proof. Both men are presumed innocent unless and until proven guilty.
