Mount Royal University, a public institution in Calgary with more than a century of history, has confirmed that a ransomware crew stole and then destroyed employee and student files during an attack discovered on 17 June 2026. The university disclosed on 7 July that folders on its "H drive" were accessed and exfiltrated by an unauthorized actor, that the data was then deleted to impede recovery, and that a second volume, the "J drive," was wiped outright. CMD Organization, a group that surfaced only this spring, listed MRU on its Tor leak site the same day the university published its update, claiming over 10 terabytes of data and demanding roughly $1.9 million in cryptocurrency. MRU has not confirmed the actor's name, the volume figure, or the ransom amount, and says it will not comment on its discussions with the threat actor or on whether it is paying.
What Happened
The core sequence is consistent across every source. MRU detected an incident on 17 June that knocked out online services, internet access, phone lines and certain internal systems, and notified its community the following day. SecurityWeek and CityNews both note the 18 June community advisory; CityNews frames the breach itself as occurring "on June 18," which appears to track the public outage rather than the 17 June discovery date every other account uses. Treat 17 June as the discovery date and 18 June as the disclosure date.
Three weeks later, on 7 July, the university published investigation findings. In its own words, quoted by BleepingComputer, the Calgary Herald and others: "data within certain folders on the University's 'H drive' was accessed and taken by an unauthorized actor," and "the actor then deleted our H drive data to impede our recovery." MRU characterized the incident as ransomware and stressed that analysis indicated specific folders were hit rather than the entire drive.
The J drive, which held departmental and corporate records, was deleted as well. MRU says there is currently no evidence J drive data was accessed or copied before deletion, and that "a full recovery may not be possible." That distinction matters: this was destruction as a recovery-denial tactic, not a second exfiltration channel.
The incident was reported to the Alberta Information and Privacy Commissioner and to law enforcement. No arrests have been announced. MRU declined to say how its network was compromised or to name the actor, citing the ongoing investigation, and has warned that assessing full impact and recoverability could take weeks or months.
What Was Taken
Accounts diverge sharply on volume, and the gap is worth stating plainly.
MRU itself has published no record count and no data volume. Its position is that exposure varies by individual, that the H drive was general-purpose personal storage, and that because the original data was deleted, reconstructing exactly what each person lost is complicated and slow. As the Calgary Herald quotes the university: "Depending on what individuals chose to store in the folder, it may contain personal information."
The 10-terabyte figure comes entirely from the attacker. SecurityWeek reports that CMD Organization claimed "over 10 terabytes" on its leak site and posted screenshots as proof of possession; Tech Insider reports the same "more than 10 terabytes" figure. Both trace to the gang's own listing, not to any independent verification, and MRU has not endorsed it. Tech Insider additionally reports that passport scans were among the files CMD published as proof; that specific claim appears in no other source and should be treated as unconfirmed.
Affected populations are firmer: current and former students, current and former employees, and, per BleepingComputer, an unspecified additional category of "other individuals." Notifications to affected people began the week of 7 July. All current employees and anyone employed in the past five years are being offered 24 months of free credit monitoring and identity theft protection, delivered by email and physical mail per CityNews.
On institutional size, sources are unreliable. BleepingComputer states MRU "currently has 11,560 students and 12,500 undergraduates," which is internally inconsistent and should not be used to estimate the affected population. No source provides a count of notified individuals.
Why It Matters
The strategic signal here is not the malware. It is the monetization model. Tech Insider reports that CMD Organization has spent roughly four months building a leak site with a built-in auction house, treating stolen data as inventory to be sold to the highest bidder rather than as leverage in a private negotiation. Per that account, the group demanded 30 BTC from MRU with a six-day deadline before the auction opened, against demands of roughly 7 to 8 BTC from earlier victims. Those specifics, the 30 BTC denomination, the six-day window, and the auction structure, appear only in Tech Insider and are attributed accordingly. The $1.9 million ransom figure is independently corroborated by SecurityWeek.
Victim-count reporting differs. Tech Insider describes growth from five organizations in April to roughly 30 by late July. SecurityWeek says the gang has claimed 32 attacks but that only four have been confirmed. Both point the same direction, a young group scaling fast, with a wide gap between claims made and claims verified. Defenders should read CMD's leak-site figures as marketing until corroborated.
Two operational lessons stand out. First, this crew paired exfiltration with deliberate destruction of the source data, which does more than block restoration: it degrades the victim's own ability to determine what was stolen. MRU is explicit that deletion is why per-individual impact assessment is hard. An organization that cannot enumerate its losses cannot notify accurately, cannot scope regulatory obligations cleanly, and negotiates from a weaker position.
Second, general-purpose personal network shares are a soft, high-yield target. The H drive was not a curated database with a data classification policy attached. It was whatever 20,000-plus students and staff chose to save there over years, which in practice means identity documents, tax forms, HR correspondence and research material sitting in unmonitored user folders.
The Attack Technique
Initial access is unknown. MRU has explicitly declined to share details on how its network was compromised, and no source in this set offers an intrusion vector, a CVE, a malware family name, or indicators of compromise. Anyone publishing a TTP chain for this incident today is speculating.
What is observable from the outcome is the actor's post-access behaviour: broad access to file storage infrastructure sufficient to read and remove selected folders across at least two distinct network volumes, bulk exfiltration at a scale the actor claims exceeded 10 TB, and destructive deletion of both the exfiltrated source folders and an entire second departmental volume. That pattern implies credentialed access at or near file-server administrative level, and enough dwell time to stage and move a very large data set without triggering an egress control that stopped it.
The disruption to internet access, phone lines and internal systems suggests either broader encryption or containment-driven shutdown by MRU's responders. Sources do not distinguish between the two.
What Organizations Should Do
Instrument egress, not just endpoints. A multi-terabyte outbound transfer is one of the few attacker behaviours that is genuinely hard to hide. Alert on volumetric anomalies per host and per user account against a rolling baseline, and specifically on file-server hosts, which should almost never be large-volume outbound talkers.
Put immutable, offline backups behind the file shares that nobody thinks of as critical. MRU's J drive may not be fully recoverable. Personal and departmental shares are frequently backed up to systems reachable with the same credentials that protect the primary. Verify that your backup tier survives full compromise of the file-server administrative account, and test restoration, not just backup completion.
Maintain an independent inventory of what lives on user shares. Run data discovery and classification across personal drives so that a destructive attack does not also destroy your only record of what was exposed. This is the difference between a defensible breach notification and a public admission that you do not know.
Constrain lateral movement to storage tiers. Tiered administrative accounts, no shared local admin credentials, phishing-resistant MFA on all privileged and remote access, and segmentation between user workstations and file infrastructure raise the cost of the credentialed-access pattern this attack implies.
Alert on mass deletion as a distinct detection. Bulk file-deletion events on network shares are a late-stage indicator that often fires before, or alongside, encryption. Wire them to an on-call path, not a daily report.
Assume public attacker claims are inflated and plan messaging accordingly. CMD's 10 TB figure and 32-victim count are unverified. Build an incident communications plan that separates what you have confirmed from what the actor asserts, and be prepared to say "we have not verified that" without appearing evasive. MRU's approach, confirming what it knows and declining to comment on ransom discussions, is the defensible posture.
Sources: CMD Ransomware Gang Auctions Data, Demands $1.9M 2026 | Mount Royal University confirms breach as hackers claim attack | Mount Royal University ransomware attack compromised ... | Mount Royal University Confirms Data Stolen in ... | MRU says employee, student data compromised in cyberattack | MRU student, staff data stolen in ransomware cyberattack Calgary H... | MRU says data was stolen, deleted in June cyberattack | Mount Royal University confirms June 17 ransomware attack stole H d...