Loading story…
Mount Royal University in Calgary confirmed that attackers breached its network on June 17, accessed and exfiltrated data from the H: drive, and then deleted the original files, while a separate J: drive containing departmental data was wiped without evidence of prior theft. The incident disrupted online services, internet access, and internal systems, and the university said the affected records may include current and former students, current and former employees, and other individuals.
The extortion group CMD Organization claimed responsibility, published samples of allegedly stolen data including passport scans, and demanded 30 BTC while threatening broader disclosure. Mount Royal University said it reported the breach to Alberta’s Information and Privacy Commissioner and law enforcement, brought in external cybersecurity experts, and warned that recovery could take weeks to months because deleted data complicates impact assessment; it is offering two years of credit monitoring and identity theft protection to current employees and people employed within the past five years.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Mount Royal University publicly confirmed the breach, reported it to Alberta’s Information and Privacy Commissioner and law enforcement, and engaged external cybersecurity experts. The university said it plans to notify impacted individuals and is offering two years of credit monitoring and identity theft protection to current employees and those employed within the past five years.
The extortion group CMD Organization claimed responsibility for the Mount Royal University attack, published samples of allegedly stolen data including passport scans, and demanded a 30 BTC ransom while threatening broader publication. One report said the group set a six-day deadline before releasing more data.
Mount Royal University said a cyberattack began on June 17, 2026, disrupting online services, internet access, and internal systems. Investigators found data on the H: drive was accessed, exfiltrated, and deleted, while data on the J: drive was deleted without evidence of exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourceteiss.co.uk
Open sourcecysecurity.news
Open sourcebleepingcomputer.com
Open sourceemergency.mtroyal.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The University of Hawaiʻi Cancer Center confirmed a **ransomware-driven data breach** affecting its epidemiology division, with the potential exposure of data tied to up to **1.2 million individuals**. The university reported that attackers accessed files containing **SSNs and driver’s license numbers** sourced from historical Hawaiʻi DOT records and Honolulu voter registration data (dating back to 1998), as well as health-related research data connected to the **Multiethnic Cohort (MEC) Study** and other diet-and-cancer studies; the incident was discovered on **August 31, 2025**, and the university acknowledged it engaged with the threat actors while restoration and impact assessment were underway. Separately, a “cyber incident” caused a **five-school-day internet outage** at the Denmark School District in Wisconsin; the **INC Ransom** group claimed the victim on its leak site, alleging both **encryption** and theft of roughly **70.76 GB** of data, though the district had not publicly confirmed ransomware or data exfiltration. In the healthcare sector, **Insight Hospital and Medical Center** in Chicago reported unauthorized network access between **August 22 and September 11, 2025**, and the **Termite** group later claimed to have stolen and then **leaked ~360 GB** (about 900,000 files) of “confidential data,” including medical imaging files (e.g., `.dcm`), raising the likelihood of exposure of both identity data and protected health information.
Jun 29, 2026
The University of Nottingham said a cyber incident exposed a significant amount of data belonging to current and former students, and warned that people connected to its campuses in Nottingham, Malaysia, and China may be affected. The university said it is still determining exactly what was accessed, but is treating **contact details, university-related information, financial data, and sensitive personal information** as potentially compromised while a third-party forensic investigation continues. It has notified affected students and alumni and published a notice confirming that student and alumni data had been compromised. The **ShinyHunters** cybercrime group claimed responsibility on its extortion site, alleging it stole more than **40GB** of material including credit card and payment details. Analysis of partially published data by **Have I Been Pwned** indicated the leak contains about **455,000 unique email addresses** along with extensive personal information, although the full scope remains unverified and ShinyHunters has previously been accused of exaggerating or misrepresenting stolen data in extortion campaigns.
Jun 29, 2026
Hackers gained unauthorized access to an online code repository at the University of Sydney, resulting in the theft of historical files containing sensitive personal information. The breach, detected by the university's security team, exposed data belonging to over 27,000 individuals, including current and former staff, students, alumni, and a small number of supporters. The compromised data includes names, dates of birth, phone numbers, home addresses, job titles, and employment dates, primarily from records dating between 2010 and 2019. The university clarified that this incident is unrelated to other technical issues reported around the same time. Upon discovery, the university immediately blocked access to the affected system and notified relevant authorities, including the New South Wales Privacy Commissioner and the Australian Cyber Security Centre. Impacted individuals are being informed through personalized notifications, and a dedicated support service has been established to assist those affected. As of now, there is no evidence that the stolen data has been published or used for fraudulent purposes, but the university continues to monitor the situation and has launched a comprehensive investigation expected to continue into January 2026.
Jun 29, 2026