2026 Cyber incident

Mount Royal University is in the final phase of recovery from the cyber incident identified on June 17, 2026. Most university systems and services have been restored, while investigation and recovery work continues in some areas.

MRU has contained the incident, engaged external cybersecurity and forensic experts, implemented additional security measures and reported the incident to law enforcement and the Office of the Information and Privacy Commissioner of Alberta.

This page provides current information about the incident and investigation, potential impacts to information, notification and supports available to members of the MRU community. It is replacing the Updates and supports page that was the source of information during the active incident.

Current status

Most university systems and services affected by the cyber incident have been restored and regular operational information for students and employees is once again available through mtroyal.ca, MyMRU and other established university channels.

The H and J drives have been restored. The investigation and analysis of information potentially affected by the incident also continues.

For university services and support, please visit the regular sites used prior to the incident, including:

About the cyber incident

MRU identified a cyber incident affecting certain university systems and services on June 17, 2026. The incident involved a ransomware threat actor.

The University took immediate steps to contain the incident, engaged external cybersecurity and forensic experts and initiated a detailed investigation. The incident was also reported to law enforcement and the Office of the Information and Privacy Commissioner of Alberta.

The investigation found that data within certain folders on the University's H drive was accessed and taken by an unauthorized actor. The actor then deleted H drive data in an attempt to impede recovery. MRU's analysis indicates that specific folders were affected rather than the entire H drive.

The threat actor also deleted MRU's J drive, which contains departmental data. There is currently no evidence that J drive data was accessed or copied before it was deleted.

There is currently no evidence that data stored within other affected university systems was accessed or copied.

The investigation remains ongoing. MRU will provide further information as it becomes available, subject to legal, privacy and security considerations.

Information for those affected by the incident

MRU has notified individuals whose H drive folders were identified as having been compromised based on the findings of the investigation to date. Notifications were sent by email or letter. If you received a notification, please review the information provided in your notice and the guidance below on protecting your personal information.

Request information about your H drive

Individuals who received notice that their H drive was affected may request a list of the names of files that were stored in their H drive.

Request your H drive file list.

The University does not monitor the contents of individual H drives and may not be able to determine what personal files individuals chose to store there.

H drive survey for employees

MRU is seeking information from employees about work-related personal information that may have been stored in affected H drives. This information will help the University assess potential privacy impacts and meet its obligations to members of the university community.

Employees who identify work-related personal information that may have been stored in their affected H drive are encouraged to complete the H drive survey. Please refer to the email you received on Sept. 3 from IncidentSupport@mtroyal.ca for more information.

Employees who may have stored research data in their H drive should also contact the Office of Research, Scholarship and Community Engagement at research@mtroyal.ca.

Credit monitoring and identity theft protection

As a precautionary measure, MRU is offering 24 months of complimentary credit monitoring and identity theft protection to all current employees and individuals employed by MRU within the past five years. Eligible individuals received information about the offer and an activation code in their individual notification.

Activation codes must be redeemed by Nov. 30, 2026.

Participation is optional, but MRU encourages eligible individuals to take advantage of the service. If you believe you are eligible but did not receive an offer, contact IncidentSupport@mtroyal.ca. For technical difficulties with the myTrueIdentity® service, contact TransUnion Canada at 1.888.228.4939.

Protecting your information

Based on the information currently available, MRU has reason to believe that information obtained during the incident has been deleted and is no longer in the possession of the individuals responsible for the attack. The University currently assesses the overall risk to affected individuals as low.

MRU continues to monitor the situation and assess potential impacts associated with the exposure of H drive data. Everyone is encouraged to take common-sense precautions to protect their personal information:

  • Be cautious of unexpected emails, calls or messages requesting personal information.
  • Do not click unfamiliar links or attachments.
  • Monitor bank, credit card and other important accounts for unusual activity.
  • Use strong, unique passwords and enable multi-factor authentication where possible.

If you experience identity fraud or another issue you believe may be connected to this incident, please report it to IncidentSupport@mtroyal.ca. Include information about why you believe the issue may be connected to the incident, but do not email confidential or sensitive personal information.

Frequently asked questions