Mount Royal University Cyberattack: Data Stolen and Deleted in Ransomware Incident

Mount Royal University (MRU) confirmed a ransomware cyberattack that occurred on June 18, 2026, affecting both student and employee data. Unauthorized actors accessed and stole data from specific folders on the university's H drive, subsequently deleting the contents to obstruct recovery efforts. The J drive, which contained departmental data, was also deleted, but there is no evidence it was accessed. The university is notifying affected individuals and offering two years of credit monitoring and identity theft protection. The investigation is ongoing, with law enforcement and the Alberta Information and Privacy Commissioner involved. Recovery of the deleted data may take weeks or months. The threat group CMD Organization claimed responsibility and demanded a ransom of 30 BTC, approximately $1.9 million.

Key Points: • Mount Royal University experienced a ransomware attack on June 18, 2026. • Data from the H drive was stolen and deleted, impacting students and staff. • The university is providing credit monitoring services to affected individuals.