Mount Royal University Hit with Ransomware, Sensitive Data Stolen and Deleted

The CMD Organization exploited Mount Royal University's file storage systems, exfiltrating sensitive data — including passport scans — before deleting it, leaving the university with no copies and significant leverage against them. This attack highlights the critical risk of storing sensitive personal documents without adequate access controls or offline backups. The $1.9 million ransom demand underscores how attackers monetize both data theft and data destruction simultaneously. Universities, which hold large volumes of sensitive personal data, are high-value targets that must treat data governance and resilience as institutional priorities, not afterthoughts.

Tactical Insight

Immediate actions

Isolate affected file storage systems and revoke broad access permissions while conducting forensic triage.
Audit all stored sensitive documents (e.g., passport scans) and apply strict need-to-know access controls immediately.

Long-term improvements

Implement an immutable, air-gapped or offsite backup strategy following the 3-2-1 rule to prevent data from being permanently destroyed by ransomware.
Adopt a data minimization policy to avoid retaining sensitive documents (e.g., government IDs) beyond their operationally necessary period.
Enforce role-based access control (RBAC) on all file storage systems to limit lateral movement and blast radius during a breach.

Detection & response measures

Deploy file integrity monitoring and anomaly detection on storage systems to alert on bulk data access or mass deletion events.
Conduct regular ransomware tabletop exercises and maintain an up-to-date Incident Response Plan (IRP) specific to data extortion scenarios.
Establish a formal data breach notification process aligned with PIPEDA and applicable provincial privacy legislation.