Mount Royal University 2026 Data Breach
The 2026 Mount Royal University data breach was a ransomware incident affecting student and employee files at the Alberta, Canada university. MRU identified the incident on June 17, 2026, and its investigation indicates that unauthorized activity began earlier.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
1- Personal information
About This Breach
Because the initial-access date has not been established, the catalog uses June 2026 month precision. June 17 is the confirmed detection date.
What happened at Mount Royal University?
According to the university's official update, an unauthorized actor accessed specific folders on the H drive used by students and employees, took data, and then deleted the drive's contents to impede recovery.
The actor also deleted the J drive used for departmental data. MRU says there is currently no evidence that J-drive information was accessed or copied before deletion. The attack also temporarily disrupted several online and internal services.
What information may have been affected?
The H drive is personal file storage provided for employee work and student academic use. MRU says folder contents varied by individual and may have included personal information selected by each user for storage there.
The investigation has not published a standard list of exposed fields, so the catalog does not add unconfirmed categories such as government identifiers, financial information, or health data. MRU also says there is currently no evidence that data was taken from other systems used for personnel records.
How many people were affected?
Mount Royal University has not disclosed a unique affected-person total. Only specific H-drive folders were affected, and their owners were notified. The university's overall student or employee population is not used as a breach count.
How did the university respond?
MRU contained the incident, engaged external cybersecurity and forensic specialists, and notified law enforcement. Notifications began on July 10, with affected individuals contacted by email or letter.
The university offered 24 months of credit monitoring and identity-theft protection as a precaution to current employees and people employed within the previous five years. That offer does not mean data belonging to every recipient was stolen.
What should affected people do?
Notice recipients can request a list of file names associated with their folder and assess what documents may have been stored there. Unexpected links or attachments should be verified through an official university contact channel before they are opened.
Monitoring important accounts, using a unique password for each service, and enabling multi-factor authentication are practical safeguards following the incident.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
