Mount Royal University: CMD Organization Ransomware and Wiper Attack

Mount Royal University (MRU) in Calgary, Alberta has confirmed that student and employee personal data was stolen, and then deliberately destroyed, in a ransomware attack first detected on June 17, 2026. In an investigation update published Tuesday, July 7, the university said an unauthorized actor accessed and exfiltrated folders on its "H drive" file storage system before wiping the contents to impede recovery, and separately deleted its "J drive" departmental storage. The attack knocked out MRU's website, the MyMRU online services portal, campus internet, and telephone lines. A ransomware group calling itself CMD Organization listed MRU on its Tor leak site the same day the university published its update, claiming over 10 terabytes of stolen data and demanding a $1.9 million cryptocurrency ransom, according to SecurityWeek. MRU has not confirmed the actor's identity and declines to say whether it has communicated with or paid the attackers.

What Happened

The timeline across sources is consistent on substance and slightly split on dates. SecurityWeek, BleepingComputer, and the Calgary Herald all put initial detection at June 17, with the university's public notice to its community following on June 18. CityNews describes the breach as occurring "on June 18, when MRU's website, phone lines, and other systems went offline," which appears to describe the point of visible outage rather than intrusion or detection. Given the weight of reporting, June 17 is the detection date and June 18 the disclosure date.

MRU engaged internal technical teams and external cybersecurity experts for investigation and recovery. The attack disrupted a broad range of services: the university website, the MyMRU online services platform, on-campus wireless internet, telephone systems, and unspecified internal systems. A temporary public wireless network was stood up on campus as a stopgap. As of the reporting window, MRU said it had no timeline for full restoration of services.

Two file storage systems were targeted. The H drive is individual-user storage provisioned to employees and students for academic and work files. MRU's analysis indicates specific folders were accessed rather than the entire drive. The J drive holds departmental or corporate data; CBC characterizes it as containing "corporate data about MRU staff," while BleepingComputer, CTV, and the Calgary Herald describe it as departmental data. MRU says there is no evidence the J drive was accessed or copied before deletion, but it was wiped regardless, and the university has stated plainly that "a full recovery may not be possible."

The incident was reported to the Alberta Information and Privacy Commissioner and to law enforcement. Calgary police confirmed last month that they were investigating.

What Was Taken

MRU has not published a record count, and no source provides one. The affected population is described by category rather than number: current and former students, current and former employees, and, per BleepingComputer's read of the university statement, an unspecified additional category of "other individuals."

Content sensitivity is inherently variable. Because the H drive is user-provisioned personal storage, MRU noted that "depending on what individuals chose to store in the folder, it may contain personal information." That is an honest but uncomfortable admission: the university cannot enumerate what was in each folder because it never controlled what users placed there, and the originals have been destroyed. MRU explicitly warned that determining exact per-individual impact is complicated by the deletion and will take time, with analysis of the fallout and recoverability expected to run weeks or months.

On volume, the only figure in circulation comes from the threat actor, not the victim. SecurityWeek reports that CMD Organization claims over 10 terabytes of data and has posted screenshots as proof of possession. That number is unverified, originates from an extortion listing with an obvious incentive to inflate, and should not be treated as an established fact. MRU has not commented on it.

For context on the actor's credibility, SecurityWeek notes CMD Organization has claimed 32 attacks to date, of which only a small number have been corroborated. That is a thin track record and a reason to treat its claims with caution.

MRU's remediation offer is worth reading closely for what it implies about scope. All current employees and anyone employed by the university within the past five years will receive 24 months of free credit monitoring and identity theft protection, delivered via email and physical mail. Coverage for students is less clearly universal: S1 describes credit monitoring being offered to "employees and recent graduates," while the mainstream outlets frame the blanket offer around the employee population and describe direct notification for affected H drive folder owners. The distinction matters to affected students and is not fully resolved by the available sources.

Why It Matters

This incident is a clean example of a shift defenders have been tracking for two years: extortion crews increasingly destroy the victim's copy rather than merely encrypt it. Encryption is reversible with a key or a backup. Deletion of source data, executed after exfiltration, converts a recoverable outage into permanent institutional loss and simultaneously raises pressure to pay, because the attacker now holds the only intact copy. MRU's own language, that full recovery of the J drive may not be possible, is the outcome that strategy is designed to produce.

The second lesson is about incident scoping. MRU is not withholding a record count out of evasiveness; it genuinely may not be able to produce one, because the evidence of what was stored was itself the target. When user-controlled storage is wiped, the victim loses both the data and the ability to determine breach scope. Any organization that provisions personal network shares without content classification or data loss prevention visibility faces the same blind spot.

Third, higher education remains a high-value, structurally soft target. Universities carry decades of student records, employee HR and payroll data, and research material across large, federated, historically permissive networks with a user population that resists tight controls. MRU is a century-old institution with roughly 11,500 to 12,500 students by BleepingComputer's figures, which are internally inconsistent in that report and should be read as approximate.

Finally, the silence on ransom is itself a data point. MRU declined to comment on discussions with the threat actor or on payment. That is standard counsel during an active investigation with police and a privacy regulator involved, and it should not be read either as confirmation or denial.

The Attack Technique

Initial access is not publicly known. MRU explicitly declined to share details on how its network was compromised or who was responsible, citing the ongoing investigation. Any claim about phishing, credential abuse, VPN or edge device exploitation, or vendor compromise at MRU would be speculation, and none of the eight sources reviewed offers one.

What can be characterized is post-access behavior, which is consistent across every account:

• Broad network access. The actor reached at least two distinct enterprise file storage systems, including departmental shares, which implies either wide-scoped credentials or successful lateral movement and privilege escalation.
• Selective exfiltration. Specific folders on the H drive were identified and taken rather than the whole volume, indicating some degree of targeting or triage rather than indiscriminate bulk collection.
• Destructive follow-through. After exfiltration, the actor deleted the H drive data and separately wiped the J drive. MRU states the deletion was carried out specifically "to impede our recovery."
• Availability impact across services. Website, portal, campus wireless, and telephony all went down, indicating the impact reached shared infrastructure well beyond file storage.
• Leak site extortion. Per SecurityWeek, CMD Organization published a listing with proof-of-possession screenshots and a $1.9 million crypto demand, timed to coincide with the university's own disclosure. That timing is a common pressure tactic: publish when the victim's community is already reading about the incident.

Attribution to CMD Organization rests on the group's own claim and SecurityWeek's reporting of it. MRU has confirmed a ransomware group was involved but has not named one.

What Organizations Should Do

1. Make backups immutable and offline. The defining feature of this attack is deletion, not encryption. Backups reachable with the same credentials the attacker holds are not backups. Enforce write-once storage or air-gapped copies for user home drives and departmental shares, and test restoration of a full share, not just a sample file.
2. Instrument mass-delete detection on file servers. Alert on anomalous volumes of delete and modify operations per account per hour against SMB and NAS shares. Bulk deletion of a departmental volume should trigger an immediate high-severity alert and automated session termination, not a help desk ticket days later.
3. Watch egress before the wipe. Exfiltration preceded destruction here. Monitor for large outbound transfers to cloud storage, file sharing services, and unfamiliar endpoints, and baseline what normal data movement out of file servers looks like so anomalies are visible.
4. Constrain access to file shares. Enforce least privilege so that no single compromised account can read and delete both individual user storage and departmental storage. Segment shares, require privileged access management for administrative operations on storage, and enforce phishing-resistant MFA on every path that reaches them.
5. Classify what is actually on personal shares. MRU cannot say exactly what was in each folder because users decided. Run content discovery and DLP against user home drives, restrict storage of regulated personal data there by policy and by technical control, and give staff a sanctioned alternative for sensitive files.
6. Plan for a scoping exercise conducted without evidence. Build the tabletop scenario where the data needed to determine breach scope has itself been destroyed. That means retaining independent metadata, file inventories, and access logs off the affected systems so notification obligations can still be met.
7. Pre-position regulator and notification workflows. MRU reported to the Alberta Information and Privacy Commissioner and law enforcement quickly, and began direct notification within roughly three weeks. Know your jurisdiction's breach reporting clock and have notification templates, call center capacity, and credit monitoring vendor arrangements ready before you need them.

Sources: Mount Royal University ransomware attack compromised student, emplo... | Mount Royal University confirms breach as hackers claim attack | Mount Royal University ransomware attack compromised ... | Mount Royal University Confirms Data Stolen in ... | MRU says employee, student data compromised in cyberattack | MRU student, staff data stolen in ransomware cyberattack Calgary H... | MRU says data was stolen, deleted in June cyberattack | Mount Royal University ransomware attack compromised student, emplo...