DOJ Charges Two in Campus Cryptomining Hacks
Federal prosecutors accuse two men of hacking educational institutions to mine cryptocurrency between 2016 and 2019.
Updated on Nov. 4, 2026 in Cybersecurity
Live Poll
Do you trust your local schools to keep your family's data safe from hackers?
Ryan James Roach and Mathiew James Stubbings are accused of stealing login credentials and using compromised computers to mine cryptocurrency. Roach was arrested and extradited from Canada and appeared in a Rochester, New York, federal court on Tuesday.
Why it matters
The case highlights how compromised computers at schools and universities can be turned into cryptomining operations without detection. Both men face a maximum penalty of 10 years in prison on the listed charges.
At their peak, the men allegedly ran 10 computers with cryptomining software after gaining access through stolen login credentials. The Justice Department has not yet secured Stubbings' extradition, leaving his custody status unresolved.
The players
U.S. Department of Justice
The federal department responsible for prosecuting federal crimes, which brought the indictment against Roach and Stubbings.
The details
Prosecutors allege that beginning in June 2016 and continuing until December 2019, the men hacked into educational institutions in New York, Tennessee, North Carolina, and Massachusetts. They allegedly used virtual private servers in several European countries to conduct the attacks and installed cryptomining software on the compromised machines.
Timeline
June 2016: Alleged hacking campaign begins.
December 2019: Alleged hacking campaign ends.
Last week: Roach is arrested and extradited from Canada.
Tuesday: Roach appears in federal court in Rochester, New York.
Roadmap
Cryptojacking, in which attackers secretly harness victims' computing power to mine cryptocurrency, has become a persistent threat to schools and universities with large networks of unmonitored machines. This indictment shows federal prosecutors pursuing such intrusions years after they occurred, across international server infrastructure.
Schools and universities that run unmonitored computers face the risk of having their resources quietly used for cryptomining, which can slow systems and raise costs. Administrators are advised to review credential security and monitor for unauthorized software on institutional devices.
The takeaway
Strong credential hygiene and monitoring for unauthorized software can help institutions detect cryptojacking before it runs for years undetected. Individuals managing shared or school-issued devices should also watch for unexplained slowdowns.
Further reading
Track more federal cases in our Cybersecurity coverage.
Source note: This article includes information reported by Therecord.
Live Poll
Do you trust your local schools to keep your family's data safe from hackers?
