Cryptomining Scheme Targeting Schools
Two men are charged over a three-year campaign that used stolen logins to run mining software on school computers.
Updated on Nov. 4, 2026 in Cybersecurity
Live Poll
Do you trust your local schools to keep your family's data safe from hackers?
The Justice Department has indicted Ryan James Roach, 35, and Mathiew James Stubbings, 41, over an alleged 2016-2019 campaign that hacked educational institutions and used compromised computers to mine cryptocurrency. Roach was arrested and extradited from Canada, while the government is still seeking Stubbings' extradition in Canadian court. This is an indictment and arrest, so the allegations are unproven.
Why it matters
The case shows how stolen login credentials can be turned into a cryptomining operation running quietly on victims' machines for years, with school and university networks as the targets. Its three-year span and the use of virtual private servers in several European countries illustrate how cross-border infrastructure is used to obscure attacks.
The indictment describes a campaign that gained access to computers, stole login credentials, and installed cryptomining software that used the victims' hardware to generate cryptocurrency. At its peak the operation allegedly ran on 10 computers, and both men face a maximum of 10 years in prison on the listed charges.
The players
U.S. Department of Justice
The federal department that brought the indictment and is pursuing extradition of Stubbings from Canada.
Ryan James Roach
A 35-year-old defendant accused of hacking educational institutions and running a cryptomining operation, arrested and extradited from Canada.
Mathiew James Stubbings
A 41-year-old co-defendant accused of the same campaign, currently held in Canada while extradition is sought.
The details
The men are accused of gaining entry to computers and harvesting login credentials, then using those credentials to install cryptomining software on the compromised machines. Cryptomining means using a computer's processing power to solve the mathematical puzzles that verify cryptocurrency transactions, which earns the operator digital currency. The alleged attacks were routed through virtual private servers, which are rented remote computers that can hide the true origin of traffic, located in several European countries.
Timeline
The alleged campaign began in June 2016 and continued until December 2019.
Roach was arrested and extradited from Canada last week.
Roach appeared in federal court in Rochester, New York, on Tuesday.
The Tech Race
Cryptojacking is typically a low-visibility form of intrusion, since mining software consumes processing power without disrupting files the way ransomware does. This prosecution extends the enforcement track against cross-border attackers who use rented overseas servers to hide their activity.
Anyone whose school, university, or work computers ran the affected systems could see slower performance or unexplained resource use if similar mining software is present. Institutions in the affected states are likely to review stored credentials and access controls, though no specific timeline for those changes was reported.
The takeaway
Watch whether the Justice Department secures Stubbings' extradition from Canada, since that result determines whether both defendants face the listed charges together. Checking devices for unexplained high CPU usage and resetting credentials that may have been exposed are practical steps administrators can take now.
Further reading
For broader context on how attackers exploit networks, explore our Cybersecurity coverage.
Source note: This article includes information reported by Therecord.
Live Poll
Do you trust your local schools to keep your family's data safe from hackers?
