Students frustrated by MRU summer cyberattack
Liam Rockcliffe, Contributor
On June 18, 2026, MRU confirmed that a cybersecurity incident was threatening the school and several services, including MyMRU, leaving students unable to access online services or change anything related to their degrees.
As universities rely more and more on technology and their online portals, they have become significantly more vulnerable to cyberattacks. With minimal ability to communicate and operate when these systems go down, these institutions have become a favourable target for hackers and criminal organisations such as the CMD organisation, which took responsibility for MRU’s cyberattack.
CMD is a budding cyberattack group which has targeted several organisations via phishing. Once inside the organisation’s data, CMD deletes and downloads whatever information would be most valuable to bidders or to the ransom-takers from the affected company.
This is the case with the MRU cyberattack, where CMD deleted the contents of the ‘J-Drive’, which contains corporate data and staff info, as well as accessed and downloaded the contents of the ‘H-Drive’, which is responsible for students’ and employees’ work (potentially including research), and may also contain personal information of staff and students.
The data on the H-drive makes it the holy grail of ransomware. According to online speculation on platforms such as Reddit, CMD allegedly demanded a ransom of 1.9 million, or 30 bitcoin, for MRU’s information to be returned safely—however, nothing has been stated or confirmed by university officials.
Effect on students
However, the price of this information is not what hurt students the most.
Instead, it was the downtime of MRU resources and services that haunted every student, particularly first-year students.
For MRU business student Aiden Iverson, the loss of these services created immense stress. This is just one story, but many students may have felt the same concerns.
Unable to access essential services such as My Schedule Builder or the base schedule adjuster, Iverson struggled to make the necessary changes to his graduation schedule.
With the uncertainty of when services would be back up, Iverson,like many students, felt pressure and concern that services may not be back up in time for the school year.
“Being unable to change–or even see my schedule just made me super uneasy. Especially since if I wasn’t able to change my schedule, it could make graduation take even longer,” Iverson said.
Registration is stressful for most students; knowing what classes to take and in what order is hard enough with the luxuries of my schedule builder and access to advisors; but remove these amenities, and it’s easy to let your mind wander and stress build.
In the worst cases, such as late registrants or first-year students, these problems are only amplified.
For a student who did not complete registering for their classes—or barely started—this stall, where they were unable to register or see what was even available, creates stress and uncertainty for the year to come.
For first-year students, this cyberattack came at the worst possible time. While registration opens for first-years as early as April, it can take time for students to learn what classes to take or how the system works.
With Canadian high schools wrapping up in late June, many soon-to-be university students have diplomas and final coursework to focus on and stress about. Tie the standard concerns of high school with the university you chose being cyber-attacked, and services going down just before you wind down for summer, it’s not unreasonable to assume that first-year students may lose faith and even regret their choice of post-secondary school.
University Support
MRU didn’t just leave students alone with this stress when services went down. They set up a temporary on-campus Wi-Fi network for current students and faculty, launched an emergency webpage, maintained communication by sending regular emails to students, and continued spring and summer classes while adapting to the cyberattack. Working alongside law enforcement and cybersecurity experts, MRU has resolved most issues arising from the cyberattack.
But for most students affected by the cyberattack, the question remains: did MRU do enough to support them, or was it too little, too late?
