---
title: Two Canadians indicted for hacking US university supercomputers to steal credentials and mine cryptocurrency; one extradited | ctxsec
url: https://ctxsec.com/items/doj-wdny-roach-stubbings-indicted-university-supercomputer-cryptomining
description: "A federal grand jury in Rochester, NY indicted Ryan James Roach, 35, of Saskatchewan and Mathiew James Stubbings, 41, of Ontario on computer-intrusion charges. Prosecutors say that from June 2016 to December 2019 they broke into networks at universities with supercomputers in New York, Tennessee, North Carolina and Massachusetts, stole logins, and used the machines to mine cryptocurrency, routing through falsely registered VPS servers and other victims' machines to hide. Roach was extradited from Canada on Oct 28; Stubbings' extradition is pending. The charges are accusations."
status: "official (U.S. Attorney's Office, Western District of New York press release, Nov 3)"
published: 2026-11-04
---

> A federal grand jury in Rochester, NY indicted Ryan James Roach, 35, of Saskatchewan and Mathiew James Stubbings, 41, of Ontario on computer-intrusion charges. Prosecutors say that from June 2016 to December 2019 they broke into networks at universities with supercomputers in New York, Tennessee, North Carolina and Massachusetts, stole logins, and used the machines to mine cryptocurrency, routing through falsely registered VPS servers and other victims' machines to hide. Roach was extradited from Canada on Oct 28; Stubbings' extradition is pending. The charges are accusations.

[← Cybersecurity News](/news) · [markdown](/items/doj-wdny-roach-stubbings-indicted-university-supercomputer-cryptomining.md)

official (U.S. Attorney's Office, Western District of New York press release, Nov 3)

2026-11-04

### Two Canadians indicted for hacking US university supercomputers to steal credentials and mine cryptocurrency; one extradited

Research computing clusters are attractive because of their compute and their shared, long-lived accounts. Watch for sustained high CPU or GPU use outside scheduled jobs, logins to cluster accounts from unfamiliar VPS ranges, and new SSH keys or cron entries on login nodes.

Sources: [USAO WDNY press release (Nov 3), via Public mirror](https://www.pubt.io/view/1BAADDFA3D34E064813F3F47340265FA30E14CFD) · [BleepingComputer: US charges two Canadians accused of hacking US universities (Nov 4)](https://www.bleepingcomputer.com/news/security/us-charges-two-canadians-accused-of-hacking-us-universities/)