In June 2026, Mount Royal University experienced a ransomware attack where hackers accessed the internal network, deleted two drives, and exfiltrated data from the H drive containing employee and student information. The ransomware group CMD Organization claimed responsibility, posting stolen data and demanding ransom. MRU confirmed the breach affected specific folders on the H drive but not the second erased storage system. The university is cooperating with law enforcement and has initiated notifications and protective services for affected individuals. Details on the attack vector or initial compromise remain undisclosed.

The attack resulted in the theft and deletion of sensitive employee and student data, disrupting internal systems and online services. The exposure of personal data poses risks of identity theft and privacy violations for current and former employees and students. The university faces operational disruption and potential reputational damage. No evidence indicates compromise of the second erased storage system. The ransomware group’s ransom demand and data leak increase pressure on the institution.

No official patch or fix applies as this is a ransomware incident affecting the university’s network. The university has reported the incident to privacy authorities and law enforcement and is providing 24 months of free identity theft and credit monitoring to affected individuals. Organizations should follow incident response best practices, including forensic investigation, network segmentation, and credential resets. Monitor vendor advisories or law enforcement updates for further guidance. Patch status is not applicable; remediation involves recovery and strengthening defenses against ransomware.