For more than three years, computers at several American universities were allegedly doing work their owners never asked for. According to a federal indictment, two Canadian men broke into campus networks, stole passwords and quietly used the machines to mine cryptocurrency for themselves. One of them is now in the United States to face charges in the university supercomputer hacking case. The other is still fighting extradition in Canada. U.S. Attorney Michael DiGiacomo announced that a federal grand jury has indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario. Both face charges of conspiracy to obtain information from and cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer. The charges carry a maximum penalty of 10 years in prison and a $250,000 fine.

Why the University Supercomputer Hacking Targeted Campuses

The indictment points to a clear reason for the choice of targets. Roach and Stubbings allegedly went after educational institutions in the United States that had supercomputers. The scheme relied on processing power. Once inside, the pair allegedly forced victim computers to run cryptocurrency mining software, putting the machines' computing power to work for their own financial gain. Machines built for heavy computation made the scheme more profitable. Victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Some of the damaged computers belonged to a higher education institution in the Western District of New York, where the case is being prosecuted.

How the Alleged Scheme Worked

According to the indictment, the scheme ran from June 2016 to December 2019 and followed a set pattern. The pair allegedly researched security weaknesses in victim networks before getting in. They accessed computers without authorization and deployed malware to take control. They then stole login credentials and sent the data to servers they controlled. Once inside a network, they allegedly used sophisticated techniques and tools to carry out reconnaissance and expand their access. The stolen login credentials were stored on their servers, the same servers that sent out malware and mining software to victim machines. The indictment says Roach and Stubbings damaged 10 or more protected computers within a one-year period, causing a loss of at least $5,000.

How They Allegedly Stayed Hidden

The case also shows the effort the pair allegedly put into avoiding detection. They used virtual private servers in multiple countries, registered under false names. Those servers delivered malware and mining software to victim computers and held the stolen credentials. To conceal their identities further, they allegedly used a server and compromised computers belonging to one victim to gain access to another. That meant intrusions could appear to come from a victim's own systems instead of from the people behind them.

Where the University Supercomputer Hacking Case Stands

Roach was extradited from Canada to the United States on October 28. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing on November 3. Extradition proceedings for Stubbings are continuing in Canada. The investigation was carried out by the Federal Bureau of Investigation, under the direction of Special Agent-in-Charge Allen D. Davis II, and the Department of Justice's Computer Crime and Intellectual Property Section. The Justice Department's Office of International Affairs helped secure Roach's arrest and extradition. Assistant U.S. Attorney Meghan K. McGuire is prosecuting the case.

What Is Still Unclear

The indictment leaves several details open. It does not say how much cryptocurrency the pair allegedly mined, how many institutions were affected in total, or which universities were targeted beyond their states. The loss figure stated in the charges, at least $5,000, is the legal threshold tied to the damage count, not a full estimate of the harm. An indictment is an accusation, not proof. Both men are presumed innocent unless and until proven guilty.

The OLVX marketplace, an illicit online platform used to sell stolen personal data, login credentials and cybercrime tools, has been dismantled following a coordinated investigation by North Macedonia’s Ministry of Interior and the US Federal Bureau of Investigation (FBI). Authorities have filed criminal charges against a 20-year-old suspect from the Tetovo area, alleging involvement in computer fraud, misuse of personal data and the production and distribution of child sexual abuse material. According to North Macedonia’s Ministry of Interior, the Cybercrime and Digital Forensics Sector submitted the charges against E.A., from the village of Golema Rečica, to the Basic Public Prosecutor’s Office in Tetovo. The investigation focused on the suspect’s alleged administration of the OLVX marketplace, which operated between 2023 and 2025. The operation began after the FBI provided intelligence that prompted a joint investigation into the platform and its associated criminal activities.

OLVX Marketplace Offered More Than 1,500 Stolen Login Credentials

Evidence gathered during the investigation indicated that the suspect administered domains and websites associated with OLVX between 2023 and 2025. The platform functioned as a cybercrime marketplace, where users could buy and sell stolen digital information, software tools and services intended to facilitate criminal activity. The marketplace primarily served cybercriminals seeking personal information and stolen login credentials that could provide access to victims’ online accounts and computer networks. During its operation, more than 1,500 sets of stolen login credentials were offered for sale, according to the authorities. The platform also used a cryptocurrency-based payment arrangement. Rather than operating an escrow service, as many underground marketplaces do, OLVX allowed users to load funds onto the site and use those funds to pay one another. The arrangement provided an alternative payment mechanism for transactions conducted through the platform.

Telegram Group Allegedly Offered Cybercrime Tools

The investigation also examined the suspect’s alleged activities on Telegram. Authorities said that between 2025 and 2026, the suspect administered an illicit online group called ONEMILI, which offered software tools and services designed to facilitate cybercrime. These included fraudulent refund schemes, according to the Ministry of Interior. Investigators also obtained evidence indicating that the suspect had acquired and possessed child sexual abuse material (CSAM) for personal use through Telegram. The allegations form part of the criminal charges filed with the prosecutor’s office. The available information does not specify whether the suspect has been arrested or whether court proceedings have begun.

FBI Investigation Highlights Cross-Border Cybercrime Enforcement

The operation marks the first jointly coordinated cybercrime operation between North Macedonia’s Ministry of Interior and the FBI, according to the ministry. The case demonstrates how intelligence sharing between law enforcement agencies can support investigations into online platforms operating across jurisdictions. Authorities have increasingly targeted illicit online marketplaces that facilitate the exchange of stolen information, cybercrime tools and tactics. Over the past five years, law enforcement agencies have taken down dozens of such marketplaces, which have become focal points for cybercriminals trading data and services. In a separate development, Microsoft announced the takedown of three popular Chinese phishing sites used by cybercriminals to send hundreds of millions of malicious messages impersonating more than 75,000 organizations worldwide. Although the cases involve different platforms and activities, both illustrate law enforcement and technology companies’ efforts to disrupt online infrastructure used for cybercrime. The North Macedonia investigation highlights the role of international cooperation in identifying platform administrators and disrupting services linked to the trade in stolen data. The Ministry of Interior said its Cybercrime and Digital Forensics Sector would continue working to combat cybercrime, protect personal data and improve digital safety.