Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university’s network.

In an update published on its website, MRU states that it has engaged technical teams and external cybersecurity experts to investigate the incident and to support recovery efforts following a cyberattack on June 17.

The incident disrupted a broad range of university systems, including online services, internet access, and certain internal systems.

MRU is a public university with a history of more than 100 years. It currently has 11,560 students and 12,500 undergraduates.

So far, the investigation confirmed that the attacker stole data stored on a drive used by students and employees for file storage, and the original copies were wiped to disrupt recovery operations.

“We regret to inform our community that our investigation has now shown that data within certain folders on the University’s “H drive” was accessed and taken by an unauthorized actor,” reads the announcement.

The university specified that the incident affected certain folders on the H drive, which contained information affecting current and former students, current and former employees of the university, and an unspecified category of “other individuals.”

Additionally, the attackers also wiped a separate drive, labeled “J,” which stored departmental data. “There is currently no evidence that J drive data was accessed or copied before it was deleted,” MRU says.

“We are still working to recover deleted J drive data, but a full recovery may not be possible.”

The university stated that the incident has been reported to the Alberta Information and Privacy Commissioner and to law enforcement authorities.

The university states that the exposed data varies by person, and because it has been deleted, determining the exact impact for each individual is complicated and will take time.

Once impacted individuals are identified, they will be contacted directly via personalized notifications.

CMD Organization claims the attack

The MRU attack was claimed by the threat group CMD Organization, which has published samples of the allegedly stolen data, including passport scans and other sensitive documents.

The threat actor asked for a 30 BTC ransom, currently around $1.9 million, and gave the university six days to respond before leaking the full set of stolen information.

CMD Organization appears to use an auction-style system, offering to sell the stolen data exclusively to the highest bidder. The threat group currently lists 30 organizations on its extortion site and operates both a clear web and a dark web portal.

MRU said that the recovery of the affected systems may take between several weeks and months and will provide updates as soon as new details become available.

The university is also offering two years of credit monitoring and identity theft protection to all current employees and individuals employed in the past five years.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

Ira Apfel sits down with Sarah McKibben, Editor-in-Chief of EdSurge to close out a full week of coverage from ISTELive 26 in Orlando. This conversation is a recap of everything that stood out once the keynotes ended and the convention floor quieted down, from a new idea called relational intelligence to a phrase about AI slop that stuck with educators all week. It only scratches the surface of what the EdSurge team gathered on the ground. Many more conversations recorded live at the conference are set to roll out across upcoming episodes in the weeks ahead. Listen now to hear what Apfel and McKibben took away from ISTELive 26 before the rest of the coverage arrives.

Listen to the episode.

Stories Mentioned in This Episode

This is a special recap episode from ISTELive 26 in Orlando where Ira and Sarah reflect on the hallway conversations, speaker presentations, and podcast interviews they enjoyed throughout the week. Featured speakers include:

• Pat Yongpradit, GM, Education and Workforce Policy at Microsoft

• Dr. Nneka McGee, Fmr. Chief Academic Officer and Founder of Muon Global

• Isabelle Hau, Executive Director of the Stanford Accelerator for Learning

• Heather E. McGowan, Bestselling Author, Leadership Expert, and LinkedIn Global Voice for Education

• Melinda Glowacki, MAT Supervisor and Leadership Coach for the University of California, Irvine

• Tambra Clark, Technology Integration Facilitator of Birmingham City Schools

• Mary Ehrenworth, Author, Speaker, Consultant, from Teachers College, Columbia University

• Philip Seyfried, Student, from Teachers College, Columbia University 

• Jessica Garner, Managing Director, Innovative Learning at ISTE+ASCD 

• Court Shuller from the Voices of Change Fellowship

This Week with EdSurge is a weekly podcast from EdSurge. Subscribe to the EdSurge newsletter for more news and analysis on education and technology.

For years, conversations around screen time have focused almost entirely on children. How much YouTube is too much? Should teenagers be on social media? When should a child get their first smartphone? A new study suggests we may have been asking the wrong question.

According to research published last month in the peer-reviewed journal Frontiers in Psychology (via Bloomberg), it’s not just children’s screen habits that matter. Parents who are constantly distracted by their phones may unintentionally weaken their emotional bond with their children, potentially leaving lasting developmental and psychological effects. The study surveyed 600 U.S. adolescents aged 12 to 17, many of whom reported feeling ignored or sidelined when their parents were absorbed in their devices.

The phone isn’t the problem. Feeling ignored is

The researchers found that excessive phone use by caregivers can contribute to what’s known as “insecure attachment” — a pattern that may make children more anxious, avoidant, and less confident in relationships later in life. According to Don Grant, a media psychologist, addiction expert, and fellow of the American Psychological Association, those effects can persist well into adulthood if left unchecked.

It “could really unfavorably impact their attachment security, which they will carry for life,” Grant said.

Grant described the issue as more than simply spending too much time on a phone. It’s about being physically present but emotionally absent. One example from the study highlights parents who proudly attended every recital or sports match, only for their children to remember them as constantly looking down at a screen instead of watching the moment unfold.

Why does this study feel different?

We’ve previously covered how excessive screen time and social media can affect children. What’s different here is that the researchers turn the spotlight onto parents instead. Their work represents one of the most comprehensive studies examining how children perceive their caregivers’ technology habits and how those habits shape the parent-child relationship.

The findings also build on growing research around “technoference” — the idea that digital devices quietly disrupt face-to-face relationships. While earlier studies largely examined its impact on romantic partners, this research suggests the same pattern may be playing out between parents and their children. It also aligns with broader trends. For instance, Bloomberg notes that nearly half of American teenagers surveyed by the Pew Research Center in 2024 said their parents were at least sometimes distracted by a phone during interactions, even though far fewer parents believed it was happening.

The funny thing is that we’ve spent years worrying about children becoming glued to their screens. This study flips that conversation on its head, suggesting the bigger issue may be what children see when they look up. After all, the moments kids tend to remember aren’t the ones spent staring at a screen, but the ones when the people they wanted to connect with were staring at theirs.

Lionel Messi, Cristiano Ronaldo, and Mohamed Salah have spent the past two decades defining one of soccer’s greatest eras. Now, as the 2026 FIFA World Cup marks Ronaldo’s final appearance at the tournament and another defining moment in the careers of Messi and Salah, they’re also preparing for life beyond the pitch.

Before Messi’s Argentina beat Salah’s Egypt in one of the tournament’s best matches on Tuesday, Salah was asked which player he would choose for one final “last dance” from a generation that included both Messi and Ronaldo. He chose Messi without hesitation. The answer carried extra weight given that Ronaldo had already confirmed this would be his final FIFA World Cup before Portugal’s Round of 16 defeat to Spain, bringing an end to his six-tournament World Cup career.

Away from football, however, the players’ futures are beginning to diverge. Messi and Ronaldo have increasingly embraced equity stakes in AI, health tech, and startup companies, while Salah has largely stuck to a more traditional mix of commercial partnerships, property, and philanthropy.

That shift has accelerated over the past decade as venture capital firms and startups increasingly seek celebrity investors who bring more than money. A footballer with hundreds of millions of followers can offer global reach, credibility, and distribution that few traditional investors can match.

“The shift from traditional sponsorship agreements towards equity stakes and startup investments reflects a broader focus on long-term wealth creation and financial security beyond an athlete’s playing career,” says Kamraan Khan, a partner at Dubai-based firm Archers Valuation and Advisory.

Over the past decade, elite athletes have increasingly traded one-off endorsement fees for ownership stakes in companies, joining a broader trend that has seen sports stars become investors rather than just brand ambassadors. In October 2022, Messi launched Play Time HoldCo, a San Francisco–based investment firm alongside entrepreneur Razmig Hovaghimian, founder of video-streaming platform Viki, which had earlier been acquired by Rakuten. The firm’s goal is simple: invest in companies operating across sports, media, and technology.

“While sponsorships typically generate income during an athlete’s peak earning years, equity investments can provide the potential for capital appreciation and, where applicable, future dividend income, helping to build more sustainable wealth after retirement,” notes Khan.

Initially reported to be targeting roughly $200 million, Play Time has since assembled a portfolio that increasingly resembles a Silicon Valley venture fund.

Per Play Time’s website, its bets include FieldAI, Fish Audio, World Labs, Perceptron, Intangible, and SuperAnnotate, alongside sports-specific investments in the FIFA-licensed mobile game Matchday and the memorabilia marketplace AC Momento.

Outside Play Time, Messi also holds an equity stake in fantasy football platform Sorare, which lets users buy and trade officially licensed digital player cards, and joined the ownership group of KRÜ Esports, the Valorant and Rocket League organization founded by his former Argentina teammate Sergio Agüero. His three-year, reportedly $20 million deal to serve as global ambassador for the blockchain fan-token platform Socios.com is a paid promotional contract, not an undisclosed equity stake.

As part of his landmark 2023 move to Inter Miami, Messi received an ownership component alongside his salary and signing bonus—an unprecedented arrangement in Major League Soccer. While reports have speculated about the size of that stake, neither the club nor MLS has publicly confirmed the details.

Sportico valued Inter Miami at $1.45 billion in February 2026, up 22 percent year-on-year and the highest valuation in MLS history.

If Messi’s investments reflect Silicon Valley’s AI boom, Ronaldo’s are centered almost entirely on health technology—an area that aligns closely with the personal brand he has spent decades cultivating around fitness and longevity.

Ronaldo became an investor in Whoop—the wearable fitness tracker and health analytics company—in May 2024, a deal that Whoop itself called “one of Ronaldo’s most significant investments to date,” after he had already been a paying member for years. “Whoop has become one of the most important tools I use to support my long-term health,” he said at the time. Whoop’s foray into the UAE is backed by both the Qatar Investment Authority and Mubadala Investment Company.

HubSpot has scrapped a plan to use its customers’ data for a new AI feature, just four days after announcing it. The CRM firm changed its terms on 1 July to pool customer data, including contact and employer details, for a tool that finds sales leads, The Information reported.

It opted users in by default. The backlash came at once.

The objection was less about AI than about consent. Customers argued that the data they had built up in HubSpot belonged to them, not to the company to share around. HubSpot set the default to opt-out. It enrolled everyone unless they hunted down a toggle. That turned a product tweak into a trust problem.

A four-day retreat

The revolt played out mostly on LinkedIn, where sales leaders and RevOps teams piled in. Some said they would switch providers. Within days HubSpot folded.

Chief product and technology officer Duncan Lennox apologised and called the change “a mistake”. He said HubSpot would not implement the new terms, and that any future use of customer data would be opt-in. The plan, in short, is dead.

The bigger nerve it hit

The speed of the climbdown says as much as the policy. Software firms are racing to bolt AI onto their products, and customer data is the obvious fuel. HubSpot is not the first to get burned. Slack drew fire in 2024, and Zoom in 2023, over terms that let them train AI on customer data. What stung this time is that CRM data is a company’s competitive asset, not just its files.

It also shows where power sits. In an era when a business can rebuild a workflow with cheap AI tools, big software vendors have less room to dictate terms. Annoy the customer base and it has more exits than it used to.

Why it matters

The episode is small, but it is a marker. Every SaaS company is weighing how to feed its AI without spooking the people who pay for it. HubSpot just ran the experiment in public, and learned that “opt-out” is now a fighting word.

ai and ml

Third-party testing shows heterogeneous compute platform combining H200s and SN50 RDUs churning out 763 tok/s in MiniMax M2.7

Intel’s big bet on SambaNova appears to be paying off in a big way. This week, the AI chip startup shared benchmark results showing its latest generation of AI acceleration, which combines Nvidia GPUs and the company’s accelerators, beating GPU-only inference platforms by a wide margin.

The testing, conducted by the AI benchmarking gurus at Artificial Analysis, showed SambaNova’s SN50-series accelerators, announced in February, churning out 763 tokens a second in MiniMax M2.7 at short context lengths (10,000 input tokens) — several times faster than competing inference providers running on GPUs alone.

Meanwhile, for longer context lengths, the company says that its platform is able to sustain more than 450 tokens a second. 

This feat was accomplished by combining Nvidia GPUs with SambaNova Reconfigurable Dataflow Units (RDUs) to form a heterogeneous inference platform.

Specifically, the computationally intensive prefill phase of the inference pipeline, during which prompts are processed and key value caches are generated, was handled by four Nvidia H200 GPUs.

Meanwhile, memory-bandwidth-bound decode operations, where output tokens are generated, were done on a single SambaNova rack containing 16 SN50 accelerators.

Disaggregating prefill from decode has become a key lever for reducing token costs for long-running AI agents, like code assistants. Nvidia initially demonstrated this with its NVL72 rack systems, by varying the ratio of GPUs used for prefill versus decode. The company further disaggregated this with its Groq-based LPX racks revealed at GTC this spring. Since then, just about everyone from AMD to AWS and Cerebras has announced some kind of disaggregated or heterogeneous inference platform using one or more accelerators.

With SambaNova’s latest performance figures, the startup hopes to demonstrate how customers can breathe new life into their aging GPU fleets by using its systems as decode accelerators. And because its systems are air-cooled, they can be deployed in existing datacenters — something that can’t be said of Nvidia’s latest generation of Rubin GPUs, which absolutely need liquid cooling.

SambaNova plans to show off even more powerful inference configs, with 128 and eventually 256 accelerators to demonstrate its ability to maintain high token generation rates at high throughput. As we’ve previously explored, this is something that GPUs alone have historically struggled with and one of the key drivers behind Nvidia’s Groq acquihire late last year.

The results come just a month after SambaNova and Intel announced Vector Core Compute would be among the first to deploy the combined GPU + RDU offering with TogetherAI as their first large-scale customer.

Ramping production of any chip isn’t a cheap prospect, but for its fifth-gen part, capital shouldn’t be an issue. On Wednesday, SambaNova completed the first close of a $1 billion Series F funding round led by General Atlantic, giving the AI chip startup an $11 billion valuation. ®

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.

The threat actor published at least 17 malicious packages simultaneously, each tasked to exfiltrate credentials and access tokens to a command-and-control server hosted on Amazon Web Services (AWS).

All three payment platforms are popular, with Paysafe being mostly used by e-commerce sites and online marketplaces, gaming platforms, travel businesses, and financial services or software-as-a-service (SaaS) providers.

Skrill and Neteller are digital wallets and money transfer services used in online betting, cryptocurrency exchanges, and on Forex trading platforms.

Software developers working on such platforms integrate Paysafe’s SDKs into apps and websites to implement a secure payments and funds management system.

According to application security company Socket, these developers are the targets of the latest campaign via the following packages:

1. npm/paysafe-checkout
2. npm/paysafe-vault
3. npm/neteller
4. npm/skrill-payments
5. npm/paysafe-js
6. npm/paysafe-api
7. npm/paysafe-node
8. npm/paysafe-cards
9. npm/paysafe-fraud
10. npm/paysafe-kyc
11. npm/skrill
12. npm/skrill-sdk
13. npm/paysafe-payments
14. pypi/paysafe-kyc
15. pypi/paysafe-payments
16. pypi/paysafe-sdk
17. pypi/paysafe-api

The researchers say that the 13 npm packages published four malicious versions, from 1.0.0 to 1.0.3, whereas the PyPI packages published only one malicious version, 1.0.0.

All 17 packages pretend to be legitimate payment SDKs, even exposing the expected APIs, but instead return fake success responses rather than communicate with Paysafe’s backend services.

The real purpose is credential theft, as the embedded malicious code searches compromised environments for secrets such as tokens, passwords, and API keys.

According to Socket, the exfiltrated data includes Paysafe API keys, AWS keys, GitHub tokens, npm tokens, hostname, username, and metadata about API usage.

The data theft module in the npm packages attempts exfiltration only if a Paysafe API key is present and activates when the fake SDK is called.

The PyPI packages automatically activate the data theft routine upon initialization and do not require a Paysafe API key to be present at all.

Socket’s analysis of the malware reveals that it includes some rather basic anti-analysis features, stopping execution if it detects fewer than 2 CPU cores or if the hostname or username contains cues indicating a virtualized environment.

It is unclear who is behind this campaign, but Socket’s report highlights some attributes suggesting that the threat actor is sufficiently technical and may return in a more organized way.

The researchers warn that the attacker’s ability to pivot between ecosystems may make it more difficult to defend if there is only one ecosystem of visibility.

If any of the listed packages were installed, developers are recommended to immediately “rotate all secrets on any machine that imported or executed this package.”

 The researchers also advise searching dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level.

It is also recommended to look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper