Ransomware attack steals staff and student files at Mount Royal

Mount Royal University in Calgary, Alberta confirmed a ransomware attack discovered on June 17 and publicly reported on June 18. The incident deleted staff and student files from the university’s H drive and erased a separate departmental storage system, disrupting internal systems and some online services and campus internet access.

Initial analysis found specific folders on the H drive were exfiltrated and removed rather than the entire drive. The university said it will notify employees and students whose H drive folders were compromised within the coming week.

In a notice the university wrote: “The H drive is a file storage system used by individual employees and students. Our analysis indicates that this incident affected specific folders rather than the entire H drive.”

Mount Royal reported the incident to the Alberta Information and Privacy Commissioner and to law enforcement and said it will cooperate with their inquiries. The university is offering all current employees and anyone who worked at MRU within the past five years 24 months of free identity theft and credit monitoring services.

The university added that the erased departmental storage system did not show evidence of data exfiltration. IT teams are performing recovery work and assessing backups while investigating the full scope of the breach.

A ransomware group calling itself CMD Organization posted Mount Royal on a Tor-based leak site, claiming to have stolen more than 10 terabytes of data and publishing screenshots as proof. The group is demanding a $1.9 million ransom in cryptocurrency.

CMD has publicly claimed dozens of attacks, but only a small number of those claims have been independently verified. Mount Royal declined to disclose how its network was penetrated or the identity of the attackers while the investigation continues.