A group operating as CMD Organization claimed an attack on Mount Royal University in Canada in June 2026, issuing a demand of 30 bitcoin — reported at approximately US$1.9 million — and claiming to have taken 10 terabytes of data.
This desk does not report ransom demands as fact and does not grade on their size, for the reasons set out at 26-0210. Both figures originate with the claimant.
Denominating In Bitcoin Moves The Price During The Negotiation
A demand stated in cryptocurrency rather than fiat has a property worth noticing: its value changes while the victim is deciding.
A university taking two weeks to consider a 30-bitcoin demand is negotiating against a number that may move materially in either direction over that period, for reasons entirely unconnected to the incident. Anyone modelling the decision has to model an exchange rate.
A Universityis A Poor Target And An Easy One
Higher education has limited ability to pay large demands from operating funds, which makes it a weak target commercially. It is also decentralised, publicly accountable and full of sensitive records, which makes it an easy one operationally — the structural point filed at 26-0305.
The combination tends to produce exactly this pattern: a substantial demand against an institution unlikely to meet it, followed by publication.
Compiled from public reporting, listed below. The demand and volume figures originate with the claiming group and are unverified. We do not know whether any payment was made. Corrections: corrections@forensicpost.com.