As reported by BleepingComputer, Mount Royal University in Calgary has confirmed that threat actors successfully infiltrated its network, exfiltrated sensitive data from file storage systems, and subsequently deleted that data — a double-extortion variant that leaves victims facing both exposure liability and permanent data loss simultaneously.
Why Universities Keep Landing in the Crosshairs
This incident is not an anomaly — it is a symptom of a systemic problem in higher education cybersecurity. Academic institutions operate in an environment fundamentally at odds with strong security posture: open networks designed for collaboration, massive and diverse user bases including students, faculty, contractors, and researchers, legacy infrastructure that resists modernization, and chronic underfunding of IT security teams relative to the volume of sensitive data they are responsible for protecting.
Mount Royal University, like most mid-sized academic institutions, likely held a wide variety of high-value data: student personally identifiable information (PII), financial aid records, health data, research IP, HR and payroll data, and donor information. From a threat actor's perspective, this is a target-rich environment accessible through a relatively weak perimeter.
The Delete-After-Exfil Tactic: Raising the Stakes
The deliberate deletion of data following exfiltration is a calculated escalation in attacker methodology. This approach serves several purposes for threat actors:
This tactic has become increasingly common among ransomware-adjacent extortion groups who skip the encryption step entirely, opting for speed and stealth over the noisy deployment of ransomware payloads.
Broader Implications for the Education Sector
Canadian and North American universities are governed by a patchwork of privacy regulations — PIPEDA federally, provincial legislation like Alberta's PIPA, and sector-specific obligations around student records (FERPA equivalents) and health data. A breach of this nature triggers mandatory notification obligations, potential regulatory investigation, and significant reputational damage at a time when institutions are competing aggressively for students and research funding.
Shield53 Perspective: The education sector continues to treat cybersecurity as an IT problem rather than an institutional risk management imperative. Until university boards and presidents treat a data breach with the same gravity as a financial audit failure, these incidents will continue to accelerate.
Shield53 Recommendations
For University IT and Security Teams — Immediate Actions
- Audit backup integrity now: Verify that backups are immutable, air-gapped or offline, and have been tested for restoration within the last 90 days. Attackers routinely target backup infrastructure before executing their primary objective.
- Implement network segmentation: File storage systems should never be directly reachable from general student or guest network segments. Lateral movement from an initial compromise should face meaningful friction.
- Deploy User and Entity Behavior Analytics (UEBA): Large-scale file enumeration and bulk data access — the precursors to exfiltration — generate detectable anomalies. These signals are often present hours or days before data is moved off-network.
- Enable logging on file storage platforms: Many institutions run NAS or cloud storage with minimal audit logging enabled. You cannot detect or investigate what you are not logging.
- Review privileged access: Conduct an immediate audit of accounts with administrative or broad read/write access to file storage. Apply least privilege aggressively and enforce MFA on all privileged accounts without exception.
For University Leadership and CISOs
- Engage your privacy officer and legal counsel immediately upon any confirmed unauthorized access — regulatory notification clocks may already be running.
- Develop and rehearse a data breach communication plan that includes students, faculty, staff, and regulators. Delayed or unclear communication compounds reputational damage significantly.
- Consider a third-party security maturity assessment if one has not been conducted in the past 18 months. Many universities are operating on assumptions about their security posture that do not reflect current threat realities.
The Mount Royal University incident should serve as a stark reminder that no institution is too small, too regional, or too mission-driven to be targeted. Threat actors follow data and opportunity — and universities have historically offered both in abundance with insufficient resistance.
