Cryptojacking Case: Canadian Extradited Over Hacks on University Supercomputers, and How to Spot Cryptomining on Your Servers

A federal case announced on Tuesday, November 3, 2026, alleges that two Canadian men broke into university computer networks across four U.S. states and quietly used the schools' supercomputers to mine cryptocurrency for profit. This matters outside universities too. The same crime, called cryptojacking, hits business servers, cloud accounts and websites, and the owner usually finds out from a slow system or a surprise bill.

What happened in the university cryptojacking case

The U.S. Attorney's Office for the Western District of New York says a federal grand jury indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario. Roach was arrested and extradited from Canada on October 28, 2026. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing set for November 3. Extradition proceedings for Stubbings are still going on in Canada.

Each man faces three charges:

• conspiracy to obtain information from and cause damage to a protected computer
• obtaining information from a protected computer
• intentional damage to a protected computer

Each count carries a maximum of 10 years in prison and a $250,000 fine. The FBI and the Justice Department's Computer Crime and Intellectual Property Section investigated.

The alleged activity ran from June 2016 to December 2019. Roach was not extradited until October 2026, nearly seven years after the alleged activity ended. Cases like this move slowly, which is one reason to keep logs longer than you think you need them.

What is confirmed, what is alleged and what is not known

Confirmed by the Justice Department release: the indictment, the charges, the defendants' ages and home provinces, and the extradition date. It also confirms that the victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts, one of them in the Western District of New York.

Alleged, not proven: everything about what the men are accused of doing. Prosecutors describe the indictment as saying they:

• hacked computers, stole login credentials and secretly mined cryptocurrency for profit
• targeted universities with supercomputers and researched security vulnerabilities in the victims' networks
• used virtual private servers in several countries, registered under false names, to deliver malware and mining software and to store stolen credentials
• used a server and compromised computers belonging to another victim to hide their identities
• once inside, used "sophisticated techniques and tools to conduct reconnaissance and expand their access within the network"
• damaged at least 10 protected computers in one year, causing a loss of at least $5,000

The release itself says a charge is only an accusation and the defendants are presumed innocent until proven guilty.

Reported but not in the release: SecurityWeek, citing Canadian court filings reported by CBC, says the hardware was used to mine Electroneum. The Justice Department release does not name a coin.

Not known: which universities were hit beyond the description above, how much cryptocurrency was mined, how the first login credentials were obtained, and how the November 3 detention hearing went. You may see this described as a social engineering attack. The release does not mention phishing or social engineering, so we are not claiming it.

What is cryptojacking?

Cryptojacking means using someone else's computers to mine cryptocurrency without permission. Mining is just raw computing work, so the attacker gets the coins while the victim pays for the electricity, the cloud bill, the cooling and the wear on the hardware. A university supercomputer is an obvious target because it is built to do huge amounts of computing. But any server, virtual machine or cloud account with spare capacity will do.

Why cryptojacking matters for a business network or website

It is tempting to treat a miner as a nuisance rather than a breach. That is a mistake, for three reasons this case shows clearly.

1. The miner is the symptom, not the break-in. Someone had to get in first, and here prosecutors say stolen login credentials were part of it. Anyone who can run mining software on your server can also read your files, copy customer data and plant something worse.
2. Your systems can be used against other people. Prosecutors say the men used another victim's server and computers to hide who they were. A compromised business server can become the next hop in someone else's attack, with your IP address on it.
3. You pay the costs. Cloud providers bill for computing time whether or not you authorized it. On hardware you own, you pay in power, heat, shorter equipment life and the cleanup.

If nobody is clearly responsible for watching and patching your servers, start with Who Is Patching the Software That Runs Your Business?. If one device on your network can reach everything else, read Your Tailscale Network Is Only as Safe as Its Weakest Device, which explains how one weak machine can open up the rest.

How to tell if your server is being used for crypto mining

Miners are built to stay quiet, but they cannot hide the work they do. Common signs:

• CPU or GPU usage that stays high for hours, especially overnight or on weekends when nothing should be running
• processes you do not recognize, sometimes named to look like system services
• new scheduled tasks, cron jobs, services or startup entries
• new user accounts or SSH keys that nobody remembers adding
• outbound connections to unfamiliar hosts on unusual ports, which can be mining pools
• a cloud bill or power use that jumps with no business reason
• loud fans and a system that feels slow for everyone

Cryptojacking checklist: what to do this week

Cryptojacking questions people are asking

What is cryptojacking?

It means using someone else's computers, servers or cloud accounts to mine cryptocurrency without permission. The attacker keeps the coins and the owner pays the costs.

Is cryptojacking illegal?

Yes. In this case prosecutors brought federal charges for obtaining information from and damaging protected computers. Each charge carries up to 10 years in prison.

Why would hackers target a supercomputer?

Because it has enormous computing power and someone else pays for it. The same logic applies to any powerful server or cloud account.

How do I know if my computer is being used to mine crypto?

Look for high CPU or GPU use that does not match what you are doing, processes you do not recognize, new scheduled tasks, and power use or cloud bills that jump for no reason.

Does antivirus catch crypto miners?

Often, but not always, because attackers rename and modify mining tools. Usage monitoring and limits on outbound traffic catch what signature scanning misses.

Was university data stolen?

Prosecutors say login credentials were stolen, and one charge is obtaining information from a protected computer. The release does not say whether research data was taken.

Can cryptojacking happen on cloud servers and websites?

Yes. Attackers can use stolen cloud keys to start mining machines on your account, and a hacked web server can run a miner alongside your site.

The bigger lesson

Cryptojacking is often the first sign that someone has a foothold in your systems, not the last. To catch it early, you need to know what normal looks like on your servers, limit what those servers can reach, and keep logs that outlast an investigation that can take years.

For help locking down your servers and remote access, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: U.S. Attorney's Office, Western District of New York; SecurityWeek.