The Mount Royal University data breach has been confirmed following a cyber incident that disrupted multiple university services in June. The Mount Royal University cyberattack, which occurred on June 18, has now been identified as a targeted attack in which an unauthorized actor accessed, stole, and deleted data stored on the university’s internal systems.   As the investigation into the cyberattack on Mount Royal University continues, the institution has begun taking steps to notify affected individuals, strengthen its response, and provide identity protection services to employees. 

Mount Royal University Cyberattack Led to Data Theft and Deletion 

Mount Royal University (MRU) in Calgary announced that its ongoing investigation has confirmed the cyber incident reported on June 18 was more than a service disruption. According to the university, an unauthorized actor gained access to specific folders within the institution’s H drive, a file storage system used by employees and students.  Investigators determined that the threat actor not only accessed and stole data from those folders but also deleted the contents afterward in an apparent attempt to hinder recovery efforts. The university emphasized that only certain folders on the H drive were affected, rather than the entire storage system.  The Mount Royal University data breach affected files belonging to both students and staff, although the full scope of the compromised information remains under investigation. 

Certain Employees and Students Impacted 

According to MRU, the H drive serves as a storage location for files belonging to individual employees and students. While the university stated that only specific folders were compromised, it will begin notifying impacted individuals within the week.  The institution has not disclosed the exact number of people affected by the Mount Royal University cyberattack, but confirmed that those whose information may have been exposed will receive direct communication regarding the incident.  As a precautionary measure, Mount Royal University will provide two years of credit monitoring and identity theft protection services to all current employees, as well as anyone who has been employed by the university within the past five years. Instructions for accessing these services will be distributed through both email and physical mail. 

Departmental Files Also Affected During the Cyberattack on Mount Royal University 

In addition to compromising the H drive, the threat actor also deleted the university’s J drive, which stores departmental files.  Although investigators confirmed that the J drive was erased, they stated there is currently no evidence indicating that its contents were accessed or copied before being deleted. Recovery efforts are underway; however, the university acknowledged that restoring all deleted departmental data may not be possible. 

Investigation Expected to Continue for Weeks or Months 

Mount Royal University said its investigation into the incident remains active and could take weeks or even months to complete. Digital forensic experts continue to examine the compromised systems to determine the full extent of the data breach and identify exactly what information was accessed.  The university indicated it will continue providing updates as new information becomes available. Officials are also working to restore affected systems following the Mount Royal University data breach, although recovery efforts remain ongoing due to the deletion of critical files. 

A large-scale cybercrime crackdown led by INTERPOL has resulted in 201 arrests and the identification of 3,867 victims across the Middle East and North Africa region. The coordinated operation, known as Operation Ramz, is being described as the first cybercrime operation of its scale conducted by INTERPOL in the MENA region. The operation ran between October 2025 and February 28, 2026, bringing together law enforcement agencies from 13 countries to disrupt malicious cyber infrastructure linked to phishing, malware campaigns, and online scams. Authorities also identified 382 additional suspects and seized 53 servers during the operation. Operation Ramz focused on tackling cyber threats that continue to cause financial and operational damage across the region. Participating countries included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the UAE. According to INTERPOL, nearly 8,000 intelligence packages and data points were shared among participating countries to support investigations and help authorities trace malicious infrastructure connected to cybercriminal activity. INTERPOL said the operation highlighted the growing importance of cross-border collaboration in combating cybercrime networks that often operate across multiple jurisdictions. “In a world where cybercriminals exploit the digital landscape without borders, Operation Ramz demonstrates the effectiveness of global collaboration,” said Neal Jetton. He added that INTERPOL remains committed to working with member countries and private-sector partners to dismantle malicious infrastructure and bring cybercriminals to justice.

Cybercrime Investigations Across MENA

Authorities involved in Operation Ramz uncovered several cybercrime operations tied to phishing schemes, malware distribution, and financial fraud. In Qatar, investigators used intelligence gathered during the operation to identify compromised devices that were unknowingly being used to spread malicious threats. Officials secured the infected systems and notified affected users to prevent further misuse. Jordanian authorities uncovered a fraudulent investment scam operating through what appeared to be a legitimate online trading platform. Victims were convinced to deposit funds before the platform disappeared. During a raid, police found 15 individuals carrying out the scams. However, investigators later determined the workers themselves were victims of human trafficking who had been lured from Asian countries with fake job offers. Their passports were confiscated upon arrival, and they were forced into cyber fraud operations. Two individuals suspected of organizing the scheme were arrested. In Oman, investigators identified a server hosted in a private residence containing sensitive information. Although the owner had legitimate access to the data, authorities found the server had multiple critical vulnerabilities and malware infections. Officials disabled the server to reduce further cybersecurity risks. Authorities in Algeria dismantled a phishing-as-a-service website during the operation. Law enforcement seized servers, computers, mobile devices, and hard drives containing phishing scripts and malicious software. One suspect was arrested in connection with the activity. Meanwhile, Moroccan authorities seized computers, smartphones, and external hard drives containing banking data and phishing software. Three individuals are currently facing judicial proceedings while investigations continue into other possible suspects.

Private Sector Partners Supported Operation Ramz

Several cybersecurity and threat intelligence organizations, including Team Cymru, Kaspersky, Group-IB, the Shadowserver Foundation, and TrendAI, supported operation Ramz. These organizations worked with INTERPOL to provide threat intelligence, internet visibility, and technical support to identify malicious servers and track illegal cyber activity linked to phishing, malware, and online scam networks. Joe Sander said cybercrime requires a coordinated international response involving both law enforcement and private-sector intelligence partners. “Cybercrime is borderless, and the only effective response is one that is equally borderless,” Sander said. “Operation Ramz is exactly that kind of response.” Team Cymru stated that it contributed external threat intelligence and internet-scale telemetry to help authorities map cybercriminal infrastructure and generate operational leads during the investigations.

Rising Focus on MENA Cybercrime Threats

The success of Operation Ramz reflects the growing focus on cybersecurity cooperation in the MENA region as phishing attacks, malware campaigns, and financial cyber scams continue to evolve. The operation also demonstrated how intelligence sharing between governments and cybersecurity firms can help authorities rapidly identify malicious infrastructure and prevent additional victims. Operation Ramz received support from Qatar’s Ministry of Interior and partial funding from the European Union and the Council of Europe under the CyberSouth+ project.