US indicts two Canadians accused of hacking universities

A federal grand jury has indicted two Canadian men accused of hacking US universities and using compromised computers to mine cryptocurrency. The allegations have not been proven in court.

Ryan James Roach, 35, and Mathiew James Stubbings, 41, each face a maximum of 10 years in prison and a $250,000 fine if convicted. The charges include conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentionally damaging one.

According to court documents, the men allegedly used virtual private servers registered under fake names in multiple countries from June 2016 to December 2019. They allegedly used malware to access networks at educational institutions in New York, Tennessee, North Carolina, and Massachusetts. The institutions were not named.

The Department of Justice said the servers sent malware and cryptocurrency-mining software to victim computers and stored stolen login credentials. Prosecutors allege the defendants stole data and credentials, deployed mining malware, and researched vulnerabilities after accessing supercomputers on the networks. They also allegedly damaged at least 10 computers over one year, causing losses of at least $5,000.

Roach was extradited from Canada to the United States on October 28 and was arraigned before a detention hearing on November 3. Stubbings is expected to be arraigned after his extradition from Canada.