Mount Royal University says ransomware attackers stole and deleted shared-drive data
Mount Royal University in Calgary says attackers in a June ransomware incident took data from a shared drive used by students and staff and then deleted it "to impede our recovery."
The confirmation, in a university statement issued in mid-July, means people whose files sat on the drive may have had personal or financial documents exposed. Deleting data after stealing it adds pressure on a victim that lacks clean backups.
What happened
Mount Royal discovered the incident on June 17 and confirmed it was ransomware, the student newspaper Calgary Journal reported. Most university web pages, including student and faculty portals, became inaccessible. The data was most likely taken in the days before discovery, the university said.
The attack mainly hit the "H drive," a shared drive for students and staff. A separate drive holding corporate data for staff and services was also deleted. The university is working with law enforcement.
What may be exposed
The Calgary Journal reported the stolen files may include sensitive material such as banking statements, as well as names, ID numbers, email addresses and grades. Faculty association president Brenda Lang said some folders held years of data, so the number of affected students cannot yet be determined.
Who claimed it
A group listed as CMD Organization posted Mount Royal on its leak site on July 7, according to the tracking site ransomware.live. The university has not publicly addressed the claim.
What we don't know yet
Mount Royal has not said how the attackers got in, whether a ransom was demanded, or how many people are affected. Its incident team said the investigation and data recovery could take several months.
What to do
Students and staff who stored files on the H drive should be wary of unexpected emails or calls, watch bank and credit card accounts for unusual activity, and change any passwords that were saved in documents on the drive.
