Mount Royal University confirmed attackers accessed and copied data from its H drive before deleting files, while a J drive was deleted without evidence of data access.
The attack disrupted multiple university systems.
CMD Organization reportedly claimed responsibility and demanded 30 BTC, though this remains unverified.
The incident highlights how data theft, deletion, and disruption can appear together alongside reported extortion claims, emphasizing the need for endpoint security, access controls, and backup resilience.
Data accessed and copied from the H drive; H drive and J drive deleted; service disruptions
Investigation Status
Ongoing; affected employees are being offered 24 months of identity theft protection and credit monitoring
Key Lesson
Strengthen endpoint visibility, access-control hygiene, and backup resilience
Introduction
The Mount Royal University breach shows how confirmed data theft, deletion, and service disruption can appear alongside reported threat actor extortion claims, even when ransomware encryption has not been publicly confirmed.
That pattern is evident in the cyberattack that struck Mount Royal University (MRU) in Calgary, Alberta, in June 2026. Attackers accessed and copied data from the university’s H drive before deleting files, while also deleting a separate departmental drive during the incident. Alongside the data loss, the attack disrupted internet connectivity, online services, and several internal systems, affecting day-to-day university operations.
Although the investigation is ongoing, the incident offers valuable lessons for organizations that rely on shared file storage and distributed endpoint environments. It also underscores the importance of distinguishing verified findings from claims made by threat actors during active investigations.
What Happened in the Mount Royal University Breach?
Mount Royal University first disclosed a cybersecurity incident after experiencing widespread disruptions across its technology infrastructure. The university reported interruptions to internet access, online services, and several internal systems during the incident.
As the investigation progressed, MRU confirmed that attackers had accessed its H drive, a shared file storage location used by students and employees. The university stated that data from the H drive was copied before the original files were deleted, with the deletion appearing to have been carried out to impede recovery efforts.
The university also revealed that its J drive, which stores departmental data, had been deleted during the attack. However, investigators said there was no current evidence that data stored on the J drive had been accessed or copied before deletion.
As part of its response, Mount Royal University announced 24 months of complimentary identity theft protection and credit monitoring services for current employees and individuals employed within the past five years. The university said it will directly notify individuals whose H drive data was identified as affected as the investigation progresses.
The university has also engaged external cybersecurity specialists to support its forensic investigation and recovery efforts. In addition, it notified the Alberta Information and Privacy Commissioner and law enforcement as it continues to assess the scope and impact of the incident.
What Has Been Confirmed—and What Hasn’t?
As with many ongoing cybersecurity investigations, some details have been confirmed by the university, while others remain under investigation or originate from the threat actor.
Confirmed Findings
Mount Royal University has confirmed that:
Attackers breached the university’s network.
Data stored on the H drive was accessed and copied.
Files on the H drive were deleted.
The departmental J drive was deleted.
There is currently no evidence that J drive data was accessed or copied before deletion.
The incident disrupted internet connectivity, online services, and internal systems.
The university has notified regulators and law enforcement and continues to investigate the incident with external cybersecurity experts.
What Remains Unconfirmed
A threat group calling itself CMD Organization reportedly claimed responsibility for the attack. The group reportedly published samples of allegedly stolen data, including alleged passport scans and other sensitive documents, and claimed to have demanded 30 BTC while threatening to release additional data if its demands were not met.
Unlike many extortion groups that rely solely on public leak sites, CMD Organization reportedly operates an auction-style model that offers allegedly stolen data to the highest bidder, potentially increasing pressure on victims by introducing multiple prospective buyers. These claims have not been confirmed by Mount Royal University.
At the time of writing, Mount Royal University has not publicly confirmed the group’s identity, the reported ransom demand, or the authenticity of all allegedly stolen data. These claims should therefore be treated as unverified unless corroborated by official findings or additional evidence.
Several aspects of the incident also remain publicly undisclosed, including:
The initial access method used by the attackers.
Whether compromised credentials, software vulnerabilities, or another intrusion vector was involved.
Whether malware or ransomware was deployed.
How long the attackers remained within the environment.
Whether lateral movement or persistence techniques were used.
The total volume and categories of affected data.
Until additional findings are released, organizations should avoid drawing conclusions beyond what has been officially confirmed.
Why the Attack Is Significant
The Mount Royal University breach incident reflects a form of cyber extortion in which data theft, deletion, and service disruption can occur together. Rather than involving only encrypted systems, this incident combined confirmed data theft, destructive file deletion, and operational disruption.
Shared file repositories can present significant risk because they often contain sensitive information and support day-to-day business operations. Compromising these repositories can disrupt productivity, complicate recovery efforts, and create data exposure risk.
The incident also demonstrates why organizations should distinguish between confirmed forensic findings and claims made by threat actors. When extortion groups publicize alleged stolen data or ransom demands, those assertions should be validated through official investigations before informing response decisions.
Ultimately, the breach serves as a reminder that cyber resilience depends not only on recovering deleted or encrypted data but also on understanding the scope of the compromise, securing affected endpoints, and restoring operations with confidence.
Attack Surface Reduction in Modern IT: The Role of XDR
Learn how attack surface reduction and XDR work together to improve endpoint visibility, and strengthen cyber resilience.
Security Lessons for Organizations
Although the incident occurred in the education sector, the underlying security challenges are relevant to organizations across industries that rely on shared storage and distributed endpoint environments.
Key measures that can strengthen resilience include:
Secure shared file storage: Apply least-privilege access controls and regularly review permissions to limit unnecessary exposure.
Maintain endpoint visibility: Use endpoint telemetry and investigation tools to review suspicious activity and help determine which managed devices may have interacted with affected resources.
Strengthen access controls: Enforce MFA where applicable, review permissions, and use supported device-compliance-based access policies to reduce unauthorized access risk.
Validate backup and recovery processes: Regularly test backups to ensure critical data can be restored quickly following destructive incidents.
Prepare an incident response plan: Establish clear containment, investigation, and recovery procedures so teams can respond efficiently when cyber incidents occur.
Taking a layered approach to endpoint management, access-control hygiene, and recovery planning can help organizations reduce operational disruption and improve recovery readiness.
How Hexnode Can Help
While no security platform can prevent every cyberattack, organizations can improve their resilience by combining proactive endpoint management with effective investigation and response capabilities.
Hexnode UEM
Hexnode UEM helps organizations maintain managed and compliant endpoint environments by enabling administrators to:
Enforce device compliance policies.
Manage patches and updates through supported Windows and macOS patch/update workflows.
Manage supported device encryption settings, such as BitLocker policies for eligible Windows devices.
Enforce policies on managed devices and use compliance status to support access-control decisions through supported integrations such as Microsoft Entra Conditional Access.
Apply consistent device configuration and compliance policies across managed endpoints.
These capabilities can help reduce configuration and compliance gaps and maintain endpoint hygiene across managed devices.
Hexnode XDR
During an incident, Hexnode XDR can help security teams perform endpoint-focused investigation and response.
Review available endpoint, threat, incident, and investigation data.
Analyze process trees during supported threat investigations.
Run advanced investigation queries on available endpoint data.
Isolate compromised devices from the network.
Use supported response actions, such as isolating devices, terminating suspicious processes, quarantining files, and running Deep Scan.
These endpoint-focused capabilities can support security teams as they investigate affected devices and perform endpoint-level containment.
Featured resource
Why XDR Is Stronger With UEM
Discover how integrating UEM with XDR enhances endpoint context, accelerates response, and strengthens cyber resilience.
While the full scope of the incident is still under investigation, organizations can draw several practical lessons:
Protect shared file storage with strong access controls and least-privilege policies.
Maintain visibility into endpoint activity to support faster investigations and containment.
Strengthen access-control hygiene with MFA, RBAC, permission reviews, and supported device compliance checks.
Regularly validate backup and recovery processes to improve resilience against destructive attacks.
Base incident response decisions on verified forensic evidence rather than unconfirmed threat actor claims.
Endpoint management, endpoint detection and response, access-control hygiene, and tested recovery strategies are important parts of cyber incident readiness.
Improve Your Cyber Resilience with Hexnode
Protect your managed devices with centralized endpoint management and endpoint-focused detection and response.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
