The Justice Department announced that Canadian national Ryan James Roach, 35, has been extradited to the United States over an alleged scheme to hack university supercomputers and mine cryptocurrency on them. A co-defendant, Mathiew James Stubbings, 41, will be arraigned after his own extradition. Both men are from Ontario, and the indictment ties them to schools in four states.
Roach Arrived From Canada on 28 October and Faced a Detention Hearing
Canada extradited Roach on 28 October. He was arraigned before a detention hearing on Tuesday, when the Justice Department made its announcement. Stubbings has not yet been extradited.
The alleged conduct is years old; the news is the enforcement action. The indictment covers activity from June 2016 to December 2019.
The Indictment Details a Three-Year Campaign Against Supercomputer Sites
According to the indictment, Roach and Stubbings hacked computers at schools that operate supercomputers. They stole login credentials, deployed malware and mining software, and used the victims’ machines to mine cryptocurrency for themselves. The universities named are in New York, Tennessee, North Carolina and Massachusetts, and one affected institution is in the Western District of New York.
Roach and Stubbings Used Virtual Private Servers Registered Under False Names
Prosecutors say the pair used virtual private servers in several countries, registered under false names, to send malware and store the stolen credentials. They also used compromised machines from one victim to hide their tracks, routing activity through a hacked university system to obscure its origin.
The Reported Damage Totals at Least Ten Computers and $5,000
The government says the pair damaged at least 10 computers over one year, causing losses of at least $5,000. The figures set a floor for the charged conduct rather than a full account of the activity over more than three years.
Conspiracy Charges Carry Up to Ten Years in Prison
The charges include conspiracy to obtain information from protected computers and to damage them. According to reporting on the indictment, the maximum penalty is 10 years in prison and a $250,000 fine per count.
Research Universities Lost Compute Time and Credentials
Supercomputers at research universities provide large amounts of processing power to scientists and students. Using that capacity for cryptocurrency mining takes it from legitimate work, and the theft of login credentials gives intruders continued access to the systems.
Cryptomining on stolen academic computing is a quiet form of intrusion. The visible effect is lost capacity rather than stolen records, and the charged loss of at least $5,000 across 10 computers is modest next to the length of the alleged scheme. The detention hearing decides whether Roach stays in custody while the case proceeds; the announcement did not report its outcome.
The case follows a familiar course for cybercrime prosecutions across borders: the activity ended in 2019, the arrest and extradition arrived years later, and the formal proceedings in the United States are beginning only now. The second defendant’s pending extradition means the case against the pair will not move forward as a joint proceeding until Stubbings is in US custody.
The allegations about virtual private servers under false names and the use of one victim’s machines as a relay show that the defendants, according to prosecutors, took steps to separate their activity from its source. The indictment does not say how investigators eventually identified the pair, and the Justice Department has not provided details of how the scheme was uncovered.
Roach’s extradition on 28 October and the Justice Department’s announcement a week later place the US case at its earliest stage. Stubbings cannot be arraigned until he is in US custody, and the department has given no timetable for his extradition.
