Contained High impact Ransomware Checked 6h ago

Mount Royal University ransomware attack

A ransomware attack hit Mount Royal University in Calgary in mid June 2026, disrupting its website, portals, campus internet and phones. The attacker copied data from specific folders on a shared staff and student H drive, then deleted the H drive and a corporate J drive. MRU says there is no evidence that J drive data was copied. The university has restored many services, including Infosilem by 2026-08-10 and the full H drive by 2026-08-13, but its investigation, remaining website and portal functions, and full recovery of J drive data remain open. CMD Organization claimed the attack, but MRU and government agencies have not attributed it to the group.

Started
Jun 17, 2026
Latest activity
Sep 1, 2026
Attributed to
CmdorganizationLikely
Where
Canada
Sectors
Education
Scale
one university, affecting its full student and staff population

Current status

MRU's Sept. 1, 2026 update says the incident is contained, but the investigation, some website and MyMRU functions, and J drive recovery remain open.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

CMD Organization claimed the attack, but MRU and government agencies have not attributed it to the group.

Impact

The attack disrupted MRU's website, MyMRU portal, campus Wi-Fi, phones and internal services for weeks. The website, phones, secure Wi-Fi and much of MyMRU were restored by late July. More services returned through 2026-08-10, including visitor Wi-Fi, Argos reporting and Infosilem. By 2026-08-13 MRU said the H drive itself had been fully restored and the old MROpen Wi-Fi network was decommissioned in favor of MRSecure and MRVisitor. By late August, network printers, scan-to-email and remote VPN access to several systems were working again, and eduroam was available to visitors, though Webfiles still showed a blank folder list and J drive data recovery was unfinished. As of Sept. 1, MRU says remaining MyMRU portal functions, remaining website functions and J drive data recovery are still in progress.

What to do

People notified that their H drive folder was affected should follow MRU's notice, monitor financial accounts and watch for unexpected messages asking for personal information. They can ask MRU for a list of filenames stored in the affected folder. Eligible current and former employees should enroll in the free credit monitoring service by 2026-11-30. Anyone who suspects identity fraud linked to the incident should report it to MRU.

Timeline

  1. Sep 1, 2026

    MRU said the incident remained contained, but its investigation, remaining MyMRU and website functions, and recovery of J drive data were still in progress.

    Containedemergency.mtroyal.ca
  2. Aug 28, 2026

    Mount Royal University said network printers and scan-to-email were working again for employees, remote VPN access to Banner, Argos, FAST and Titanium was restored, and eduroam was available to campus visitors again, but Webfiles still showed a blank folder list pending drive permission setup and J drive data recovery remained unfinished.

    Containedemergency.mtroyal.ca
  3. Aug 13, 2026

    Mount Royal University listed the H drive as restored and shut down its temporary open WiFi network. Recovery of J drive data and some portal and website functions remained ongoing.

    Containedemergency.mtroyal.ca
  4. Aug 13, 2026

    MRU said the H drive has been fully restored and the older MROpen Wi-Fi network was decommissioned in favor of MRSecure and MRVisitor, while remaining MyMRU portal functions, remaining website functions and J drive data recovery were still in progress.

    Containedemergency.mtroyal.ca
  5. Aug 10, 2026

    MRU said Infosilem was live. Its incident page said the investigation and full recovery of systems and H drive and J drive data remained ongoing.

    Containedemergency.mtroyal.ca
  6. Aug 6, 2026

    Mount Royal University restored visitor WiFi and Argos reporting, while its investigation and recovery work remained ongoing.

    Containedemergency.mtroyal.ca
  7. Aug 6, 2026

    MRU restored visitor Wi-Fi and Argos reporting, while its official incident page said the investigation and full system and file recovery were ongoing.

    Containedemergency.mtroyal.ca
  8. Aug 4, 2026

    Continuing Education registration and payment services became fully operational.

    Containedemergency.mtroyal.ca
  9. Aug 4, 2026

    MRU said Continuing Education registration and payment processing were fully operational.

    Containedemergency.mtroyal.ca
  10. Jul 31, 2026

    Cyber Daily reported that CMD Organization claimed an attack on Contact Group in Tasmania and said the group's leak site listed 42 victims. Contact Group did not confirm the claimed attack.

    Containedcyberdaily.au
  11. Jul 29, 2026

    Mount Royal University said it was actively recovering data from the H drives that had been reported deleted.

    Containedemergency.mtroyal.ca
  12. Jul 29, 2026

    MRU said it was actively recovering data from H drives that had previously been reported as deleted.

    Containedemergency.mtroyal.ca
  13. Jul 27, 2026

    The university said the incident was contained, assessed the overall risk to affected people as low, and offered 24 months of credit monitoring to current employees and people employed within the past five years.

    Containedemergency.mtroyal.ca
  14. Jul 27, 2026

    MRU said the incident was contained but the investigation and recovery remained open. It said it had reason to believe the stolen information was deleted and assessed the risk to affected people as low.

    Containedemergency.mtroyal.ca
  15. Jul 24, 2026

    Mount Royal University restored MyMRU, course registration, payments, transcript requests, employee portal access, secure campus WiFi and single sign-on, though some functions remained unavailable.

    Containedemergency.mtroyal.ca
  16. Jul 24, 2026

    MRU restored much of its student and employee portal, secure campus Wi-Fi and single sign-on, although some portal links and functions remained unavailable.

    Containedemergency.mtroyal.ca
  17. Jul 21, 2026

    CTV News Calgary reported the MRU community was still feeling the effects of the attack more than a month later, with some community members calling on the school to open an independent investigation.

    Containedctvnews.ca
  18. Jul 19, 2026

    MRU said staff were still working with law enforcement to recover from the attack, with some deleted data possibly unrecoverable and no restoration timeline given.

    Containedcalgaryjournal.ca
  19. Jul 10, 2026

    Mount Royal University began notifying people based on findings from its investigation.

    Containedemergency.mtroyal.ca
  20. Jul 9, 2026

    The university said it was notifying affected students and employees but would not provide credit monitoring.

    Containedtechtimes.com
  21. Jul 7, 2026

    A group calling itself Cmdorganization listed Mount Royal University on its ransomware leak site, claiming more than 10TB of stolen data.

    Activeransomware.live
  22. Jul 7, 2026

    The university confirmed an unauthorized actor accessed, took and deleted data from a file storage system holding employee and student information.

    Activemsn.com
  23. Jul 7, 2026

    MRU confirmed the incident was ransomware, said data was taken from its H drive before the drive was deleted, and said a corporate J drive was also deleted.

    Activecbc.ca
  24. Jun 18, 2026

    Mount Royal University said it was investigating a cyberattack that disrupted its systems.

    Emergingyahoo.com
  25. Jun 18, 2026

    The cyberattack disrupted MRU's website, MyMRU portal, campus internet and phone service, and the university said it was investigating.

    Activethecyberexpress.com
  26. Jun 17, 2026

    An unauthorized actor accessed Mount Royal University's network, and the school later said this is when data was likely taken.

    Emergingcalgaryjournal.ca

Sources

Related reports