MRU’s online services accessible following security incident
By Acacia Carol, Layout Editor
Since June 18, 2026, online services for Mount Royal University (MRU) have been paused while the university continues to deal with a cybersecurity incident that has students’ and employees’ personal data being held for a $1.8 million ransom.
With a month between the initial incident and now, The Reflector has created a timeline to highlight how the incident has unfolded.
June 18
MRU reached out to students and employees via email with information on a “cyber incident” that affected access to university systems and services.
“Yesterday, the university advised the community that it was experiencing technical disruptions affecting certain systems,” MRU wrote. “When the issue was identified, the university took prompt steps to contain the threat and protect its systems.”
MRU also included that it has reported the incident to law enforcement and external cybersecurity experts. The university could not determine whether any personal data or additional information was accessed or taken.
A public wireless wifi network was set up on June 19. The university wrote in an email to employees and students that the network would be available for accessing Gmail, Google Drive, and other services.
Employees also received an email stating that there would be no delay in payroll. Shortly after, on June 21, employees were notified that they had to undergo a mandatory laptop software installation on all MRU-issued laptops.
July 15
According to the update and support page, MRU confirmed that student and faculty data was accessed through the university’s “H Drive.” In an email sent to MRU employees, the university wrote that the drive was accessed and data was deleted to impede recovery efforts.
The university was unable to confirm what specific documents or records were contained in the affected drive, as the investigation was ongoing. MRU also confirmed that the H drive was previously accessible only on campus.
“Prior to the cyber incident [the H drive] could be accessed on Windows-based computers through File Explorer under This PC,” MRU wrote on the updates and support page. “If additional information becomes available that affects you, the University will contact you directly.”
The university also confirmed that the attack impacted the “J Drive,” which contained corporate data about staff, although internal data found that this drive was not accessed or copied before it was deleted.
July 22
MRU had been frequently updating the frequently asked questions (FAQ) portion of the updates and support. There, MRU confirmed that the incident was the result of a ransomware attack.
So, did the university pay? Currently, it’s unclear.
“We are not commenting on specific discussions with the threat actor,” the university wrote on the FAQ page. “Our focus has been on containing the incident, investigating what occurred, and supporting our community.”
July 24
myMRU is confirmed as back up and running. Students can register for fall and winter courses, make payments, and request confirmation of enrolment for student aid. Students are also advised to reset passwords.
In an email sent to MRU students, the university advised that there would be a delay for students seeking access to transcript services, and that some links on myMRU remain inaccessible.
Liv Lopez, REC vice president of student affairs with the Student Association of Mount Royal University (SAMRU), says that while there is some room for improvement, SAMRU was able to effectively communicate with the university to support students.
She says that while student perspectives aren’t a monolith, she’s noticed themes of confusion, anxiety and frustration from students. Following initial confusion during the transition from spring semester to summer, Lopez says there have been difficulties.
“It’s hard to know what’s going on,” Lopez explains. “The messaging we’ve gotten from the university and a lot of the administration there has been, ‘we only know what we’re told,’ and that’s not the full story.”
Still, Lopez says that the quick creation of a student section on the updates and support website was indicative of how important having student-centred updates and various ways to communicate with a large and varied student body is.
“Students are not always the most reachable via email anymore,” she says. “I understand that there are limitations to institutions…but I would like to see a diversification of communication.”
However, not all employees share that perspective. Criminology professor Kelly Sundberg told CTV that the incident was an “embarrassment” that highlighted the “erosion” of MRU.
Currently, MRU is offering credit monitoring to current and past employees, including students employed as research assistants or with MRU residence. This monitoring is not being extended to the student body at large.
Students directly affected by the H drive data breach have been notified by MRU. SAMRU’s Student Advocacy Resource Centre has continued to run throughout the security incident and can support students who have been negatively impacted by the data breach.
