Ryan James Roach, a 35-year-old Canadian from Saskatchewan, now faces federal computer-crime charges in Rochester, New York, after Canada handed him over on Oct. 28. Prosecutors allege he and a second Canadian spent more than three years breaking into university computer systems and quietly running cryptocurrency-mining software on them. The accusation covers June 2016 to December 2019, and none of it has been proven in court.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Roach, Stubbings and the three counts
A federal grand jury in the Western District of New York indicted Roach and Mathiew James Stubbings, 41, of Ontario. Each man faces three counts: conspiracy to obtain information from a protected computer and to cause damage to one, obtaining information from a protected computer, and intentionally damaging a protected computer. Every count carries a maximum of 10 years in prison and a $250,000 fine, according to the Justice Department’s release from the Western District of New York.
Roach was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing set for Nov. 3. Stubbings has not been brought to the United States. His extradition is still being fought through the Canadian courts, as The Record reported. U.S. Attorney Michael DiGiacomo announced the indictment, Assistant U.S. Attorney Meghan K. McGuire is prosecuting, and FBI Special Agent in Charge Allen D. Davis II directed the investigation, with help from the Justice Department’s Office of International Affairs in securing the arrest.
Inside the alleged mining operation
The indictment describes a routine that begins with research. The men allegedly studied U.S. educational institutions that operate supercomputers, looked for weaknesses in their networks, broke in, deployed malware, stole login credentials and then forced the machines to mine cryptocurrency for them. The Justice Department’s release does not say which coin was mined, and Decrypt noted that the department did not specify it either.
To keep their identities hidden, prosecutors say, the pair rented virtual private servers in several countries under false names. Those servers delivered the malware and mining software and stored the stolen credentials. The men also allegedly used a server and compromised computers belonging to another victim as a screen. At its peak, the scheme allegedly ran mining software on 10 computers, according to the indictments cited by The Record.
The phrase protected computer, used in each of the three counts, is the federal computer fraud statute’s own term; the text of 18 U.S.C. 1030 defines the offenses of obtaining information from, and damaging, such machines, and treats conspiracy to commit either as punishable the same way as the completed act. Prosecutors also allege a loss figure: the damage to 10 or more protected computers within one year, with losses of at least $5,000, which is the aggregate threshold that statute uses for its damage offense.
Cryptojacking of this kind is a long-running way to turn stolen computing power into money. Decrypt, in covering the extradition, noted that Monero has long been popular for such schemes because it can be mined on ordinary hardware, and that a Google Threat Intelligence Group report published this week says attackers are shifting toward hijacking access to companies’ AI models and passing on the bills, which Google calls LLMjacking. Supercomputers sit on the older side of that shift: their value to a thief was raw processing time.
Which institutions the case names, and which it does not
The victims are institutions in New York, Tennessee, North Carolina and Massachusetts, including one institution of higher learning in the Western District of New York where some of the damaged computers were located. No school is named in the Justice Department’s release or in The Record’s coverage, so the public record does not show which universities lost computing time or what the damage cost. Without a named school, readers cannot tell whether the affected machines were research clusters, teaching labs or shared regional facilities, or how long each was used for mining before the intrusions stopped.
The age of the case is its own story. The alleged conduct ended in December 2019, and the extradition came almost seven years later, after what Advisor.ca described as an indictment by a grand jury in Western New York. A CTV News report from June 2026 said a King’s Bench judge had committed an unnamed Saskatoon man for extradition on hacking charges, but that report did not name him or the alleged scheme, so a link to Roach is not confirmed.
The department’s release carries the standard reminder that an indictment is merely an accusation and that the defendants are presumed innocent until proven guilty. What the public still cannot see is the evidence tying either man to the 10 computers, the identity of the universities, and the volume of cryptocurrency that the machines are alleged to have produced. Roach’s detention hearing outcome had not been reported by Nov. 5, and Stubbings remains in Canada.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
