A long-form account connecting the RRC Game Development application, the July 3, 2025 start of the documented incident, and the records and institutional responses that followed.
03
July 3, 2025
Documented incident start identified in this record.
69dated and indexed entries10reviewed image exhibitsOctober 16, 2026latest retained event
01
Application and context
Before the incident record
The correspondence begins with the Game Development application and the contacts that provide context for the later record.
The user identifies the Winnipeg Game Collective Discord as the origin context. They state that the hacking and stalking documentation officially began on July 3, 2025, around the days they were removed from the Discord, and that the activity became worse afterward. The supplied invite identifies the group as Winnipeg Game Collective. The local archive contains no Discord message export, membership record, or removal notice, so this item records the user's chronology and keeps the missing Discord materials identified as a source gap.
A retained dashboard screenshot lists formant.ca, redrivercollegedevelopmentscandal.ca, mountroyalaccountability.ca, and other sites with creation-age and recent visit counts. The image does not establish who created or visited the listed sites, nor does it display a clear capture date.
A Cloudflare status/path screenshot displays 1,871 total rows and request-status/path counts, including `/rrc-submission` and the RRC scandal route under 504 responses. The image does not display the query, source filename, or date range, so it remains an undated summary exhibit separate from the rebuilt December request logs.
The UofM complaint form places Tyler's admission to General Studies and his disclosure of ADHD and mobility impairment to the Indigenous Student Centre in August 2025. It says the centre directed him to Student Accessibility Services.
Haley Pratt sent application instructions, the Indigenous-application fee-waiver steps, and an information-session invitation. Separate messages from Indigenous Student Supports and Accessibility Services described available support and accommodation steps.
The inquiry was forwarded to Game Development Chair Chris Brower. The thread clarified the Programming and Art streams, discussed programming preparation and Game Jams, and included Tyler's project descriptions, portfolio links, and CV attachment.
Tyler asked why he had not received a decision and described his portfolio and Winnipeg Game Jam project. Brower replied that the April 30 application deadline had not passed.
A form email to the Indigenous Student Support Team states Tyler had been told he ranked 10th and that a remaining seat was being prioritized for an international student; it requests advocacy or guidance and links to the RRC submission page.
Coordinator Guy Gagnon offered to seek guidance from Elders. Tyler described concerns about the selection process and Ubisoft partnership, requested a meeting, and the thread records scheduling exchanges through June 17.
RRC Polytech's response to the MHRC complaint says Ubisoft contacted RRC on June 16, 2025, about the complainant's LinkedIn message to an executive. The response calls Ubisoft an “important Industry Partner for RRC Polytech in the game development space.” This records RRC's stated partner relationship and receipt of a communication from Ubisoft; it does not itself show that Ubisoft participated in later website activity.
July 3, 2025 is the start date identified for the hacking and stalking documentation. The entries bring together the first retained exhibits and communications around the Winnipeg Game Collective context.
The retained Cloudflare screen shows a request list for craftedbycrystal.ca at 6:31:05–6:31:09 PM, with multiple client addresses visibly beginning 2604:3d09:b77d:f80:5df2:3fa… and a separate 142.161.92.190 row. A second crop shows the same visible IPv6 prefix at 6:31:06 PM. The screenshots do not expose full IPv6 addresses.
The compiled Firestore cleanup summary records six cleanup runs over nine minutes under attacker label james / domain james315.space, with Bible-text token flooding and a target count of 908,376 rows. These are cleanup-log records about stored data; they are not a network identity join.
The retained Formspree email contains sender-provided Patrick S Tomlinson and patrickstomlinson@gmail.com fields and hostile language including a prison threat. A separate Cloudflare screenshot displays 750 rule events for Aug 9, including 407 JS Challenge and 343 Interactive Challenge outcomes; the chart tooltip shows 170 interactive challenges at 3:45 AM.
A second retained email from lmfao@cmondawg.com taunts Tyler about BCIS and the website. The Cloudflare request graph shows a 10.28k request point at Aug 10, 2025 7:00 AM and an overall total of 58.52k for the displayed graph window. A separate image named as an 8 AM Aug 10 capture has a tooltip reading Aug 7, 2025 8:00 AM (9.11k); the filename and embedded display date differ.
A retained Gmail screenshot is stamped Sep 5, 2025 12:46 AM and displays '(no subject)' and '(unknown sender)'; the visible message body is blank. It cannot establish the sender, content, or a Discord connection.
Student Accessibility Services confirmed that it had received Tyler's online intake form, recorded his preference to receive accommodation information by email, and named Jennifer Karwowski as his coordinator. The office said Jennifer would review the form and follow up on September 24.
The compiled site cleanup summary records the phrase 'SHADOW WIZARD MONEY GANG - IRELAND DIVISION' in four mailingList cleanup notes and reports large deletion counts. The label is in application cleanup data; it does not itself identify who wrote it or prove that a later network event shared an operator.
On September 11 Tyler wrote to Jennifer about hip and mobility limitations, requested accommodations for attendance, standing, sitting, and campus travel, and offered to provide additional paperwork. Jennifer replied September 18 requesting documentation verifying the mobility impairment and set aside September 24 to review his intake and on-file medical documentation. Tyler replied September 19 that he had a doctor-signed and stamped file about pain and hip issues.
Tyler followed up with Desiree Morrisseau on September 12 after an advisor meeting about accessibility support and legal resources. Desiree replied September 17, added Indigenous Student Centre Director Carla Loewen, and asked her to connect with Tyler. Carla explained the centre's two-business-day response guideline and said Meghan Young's September 15 follow-up had met it. Tyler replied September 18 that the delay had pushed support past the weekend while he was seeking help on a human-rights timeline. Carla's September 19 reply acknowledged the delay was frustrating and referred him to Case Management.
Franklin Bristow emailed Tyler on September 16 after a teaching assistant relayed concerns about in-person assessments. Bristow offered remote, synchronous screen-sharing for observed assignment tasks. Tyler accepted on September 17 and proposed monthly Zoom check-ins or short recordings for software checks. On September 23 Bristow apologized for a delayed reply, clarified that remote assessment applied to observed assignment tasks, and said quizzes and the final exam remained in person. On September 25 he reiterated that course policy and SAS communication governed the accommodations, offered a no-penalty extension on the first assignment to October 2, and proposed a remote meeting.
Tyler emailed Shelby Thomas about his MHRC matter involving RRC and Ubisoft, described account-access attempts and anonymous threats after contact with the Dev Club, and asked for an investigation, IT-security involvement, and a virtual or telephone meeting. Shelby offered to meet. Tyler clarified that he was seeking help with security and privacy.
Tyler wrote that the Dev Club was connected to PegJam, RRC, and the Game Development program. He described account-access attempts, hostile messages, and a threatening email, attached an MHRC submission, and directed Shelby to his published record.
Jennifer confirmed Tyler's SAS registration and listed the accommodations supported by his submitted medical documentation. The plan included occasional class absences, assignment extensions of up to two days by arrangement, seating support, on-campus transportation, an SAS testing space, 50% extended exam time, and an ergonomic chair. The message instructed Tyler to sign the consent form and activate accommodations in the student portal so instructors would receive the official letters.
Jennifer sent Tyler instructions to register for Kurzweil through the University's SAS license, including setup guidance for scanned course readings and optical character recognition.
After Tyler reported a link between the Dev Club and his broader RRC/MHRC concerns, Shelby said her office did not oversee the UMSU-registered student group and that she had contacted UMSU to identify the relevant executive and complaint process. On September 29 she told Tyler she had not arranged a meeting before her leave and had asked a coworker to continue the contact.
The record expands through chat captures, request logs, referral activity, and reports to University staff. Each entry places the underlying observation beside the message or interpretation attached to it.
UofM
UMSU
Integrated RRC, MHRC, UofM, and accommodation chronology
In a December 6 email to Shelby, Tyler cited media reporting that UMSU Vice President Student Life Hannah Le had been suspended on October 3. He said he had submitted a complaint through the UMSU online form and later sent it directly to Le, with no response. The attached news report and UMSU submission receipts are not included in the retained email chain.
The retained chat export contains five blade/vein-themed messages between 12:48:13Z and 12:48:56Z, followed by messages asking whether the recipient remembered the prior conversation. A honeypot rate record with the same browser fingerprint appears at 12:49:44Z, 48 seconds after the final message. The corrected 30-second join found no client-IP event for this interval; the chat rows themselves contain no IP.
The rebuilt AS6327 log records 2,078 requests from 28 addresses in 2604:3d09:a47e:ac00::/64 over this period; 776 target the /2604 endpoint. Firebase separately records 83 geo events for one address in that /64 across seven source files, Oct 31, 2025–Feb 28, 2026.
The corrected temporal join compares 62 dated user messages and reports three single non-hosting IP candidates within 30 seconds: a Shaw address near the Oct 15 development-test message, a TELUS address near the Oct 17 'Abused' message, and a PT Callysta address near the Oct 25 message. None is within 10 seconds. These are timestamp associations; the chat rows do not contain the candidate IPs.
The complaint form says an unidentified staff member told Tyler, “If you’re such an expert, then why are you calling?” and ended the call. The form says he raised the incident and did not receive an acknowledgment or staff identification. No call recording or contemporaneous email about the call is in the reviewed set.
The complaint form says Tyler's Registrar inquiry about sponsorship and funding was redirected to Financial Aid. It also states his SAS accommodations were not granted until the day of midterm exams. The corresponding Registrar, Financial Aid, and SAS messages are not in the reviewed email folder.
The compiled campaign summary reports 192 hits from three AS60068 DataCamp addresses in a window labeled the Oct 29 Ireland assault. The same report separately records the Ireland Division cleanup label on Sep 10.
The compiled telemetry report describes repeated activity in the Shaw 2604:3d09:a47e:ac00::/64, including 26 events from one address across about 22 hours and a roughly 30-minute interval. The same prefix appears in the broader Oct 2025–Mar 2026 request set.
Tyler emailed Shelby a summary alleging barriers across SAS, the Faculty of Science, Financial Aid, and UMSU. He said he had used the UMSU complaint channel before October 16 and had also contacted Hannah Le, and cited a report that Le had been suspended. He said the route Shelby had directed him to was not functioning and connected that failure to the need to escalate to the MHRC. This is Tyler's account; the source set does not include UMSU's case records.
The rebuilt request window contains 20,594 unique requests, including 2,226 AS17001 rows. The separately compiled UofM substantive subset has 208 requests from seven IPs; the HeadlessChrome subset has 11 requests from one IP. The persistent-network linker finds seven network families in the full window, but none in the substantive or Headless subsets against its five compiled persistence references.
Tyler wrote that LinkedIn timing, network fingerprints, and digital patterns matched actors he had been tracking, and requested an urgent meeting with Shelby and the student group's supervisors. The message records his claim and the evidence categories he cited; the email itself does not include the underlying datasets.
Shelby said Matthew Chomyn from UMSU might assist with student-group complaints, asked whether she could contact him about a three-person meeting, and requested Tyler's availability. This was a proposed referral and meeting, not a documented investigation finding.
The screenshot lists five short UofM HTTP sessions across four IPs from 15:13:16Z to 17:52:48Z, plus an 'Intensive Automated Scanning' interval from 16:04:55Z to 16:06:18Z with signatures including `sftp.json`, `actuator`, `all_dbs`, `swagger`, and `server-status`. The image itself lists 65.87.7.112 and 114.111.32.123 for the scan section; its 'three users' note is screenshot-authored, not a verified person count.
The retained Cloudflare rows show 11 requests from `130.179.244.135` (AS17001, University of Manitoba) using a HeadlessChrome user-agent, from 10:00:07 to 10:35:31 CST. Nine repeated `GET /` requests received 403 responses; two `GET /favicon.ico` requests received 200 responses. The interval spans 35 minutes 24 seconds.
Shelby said Matthew had confirmed he could help with the student complaint process, but UMSU would close after that day until January 4, and suggested a meeting during the week of January 5. The email says “January 5th, 2025,” although it was sent December 12, 2025; the year is preserved as written and appears inconsistent with the surrounding dates. No meeting outcome appears in the retained chain.
Human-rights and IT correspondence moves the story into formal review. The February exchange includes both sides correcting an earlier exploit-path attribution.
RRC Polytech
Ubisoft
MHRC
Game CollectiveRRC / community context
Integrated RRC, MHRC, UofM, and accommodation chronology
RRC Polytech's response identifies the complaint as filed January 21, 2026, summarizes the allegations about admission, suspension, accommodation, and reprisals, denies discrimination and reprisals, and asks the Executive Director to dismiss the complaint without investigation under s.26(2). This is RRC's pleaded position, not an MHRC finding.
The rebuilt Shaw log records 42 requests from 2604:3d09:b77d:f80:209d:281d:8320:6897 over five seconds; 41 target /2604 and all return 301. The address shares the visible /64 from the Jul 3 screenshot.
David Treble said the review examined Tyler's data and UofM internal logs and found no evidence that the identified UofM IP addresses were part of malicious or coordinated efforts. He characterized the UofM activity as typical use or routine Cloudflare challenges and offered technical support if a report went to the Office of Human Rights and Conflict Management.
Tyler replied that his submitted data included tightly clustered requests for paths such as `/.vscode/sftp.json`, `/actuator/env`, and `/_all_dbs`, and asked UofM for corresponding outbound or proxy logs. His email attributed those requests to UofM IP space; subsequent messages in the same thread disputed that linkage.
Six Cloudflare rows carry the exact Kiwi Farms thread URL: five page-one records from five IPs (four DataCamp, one Proton) and one page-three record from a DataCamp IP. They span Feb 9–11; five records are DataCamp and one Proton. The referral builder retains each exact URL and source rows.
Treble said the exploit-path rows in the first section of Tyler's report did not show UofM source addresses and that the separate UofM HTTP request rows did not contain the same exploit GETs. He also described the DEC9-12 UofM visits as lasting no more than 1.5 minutes. The retained December 12 export records 11 HeadlessChrome requests from University address `130.179.244.135`, with repeated root requests returning 403 over a 35-minute interval. That timestamped sequence directly conflicts with his blanket description of brief UofM activity. One request at 10:06:08 CST falls within the scan interval's cited clock times. Treble's February 10 correction about two external scan addresses is separate from this University-network activity.
The blog-post record quotes the thread URL. The chat export contains 36 inbound messages; 28 form a repeated sequence from 1:22 PM to 11:24 PM Winnipeg time at 19m48s–27m18s intervals. A message at 8:13:13 PM explicitly names Kiwi Farms. The compiled reports link some chat timing to traffic candidates, with levels and non-matches itemized separately.
Treble wrote that he had found no source-IP attribution for the exploit GETs in the provided excerpt and “shouldn't have linked” the two external addresses to them; he identified 114.111.32.123 as a Naver crawler based on its user-agent and registration. Earlier that morning, Tyler wrote that he had re-examined the data and that there was “not sufficient evidence” to connect the UofM traffic to the Shaw/MTS activity or to attribute the exploit/probing behavior to UofM users or infrastructure. This correction narrows the UofM technical claim; the other 2025–2026 network records remain separate entries in this map.
Later that day, Tyler told Treble he believed an abusive-message sender was June Page from the Winnipeg Game Jam Collective, linked the messages to students, and said he hoped linking the traffic would stop it. This message followed Treble's February 9 email identifying the DEC9-12 file he had reviewed and describing the UofM visits as no longer than 1.5 minutes. The retained ticket thread ends without a reply to Tyler's student-connection message. It does not answer whether students in the referenced lab sessions were Dev Club members.
A retained email notice displays the sender name Joshua Moon and admin@kiwifarms.net, and contains claims about monitoring, malicious traffic, and legal action. Those sender fields are reproduced as displayed in the retained email report.
The updated collections contain 72 honeypot view records and 30,508 telemetry outcomes: 26,501 rejected, 3,889 hard_blocked, 72 redirected, and 46 accepted. The compiled direct-IP/device comparison found no records in these two security collections carrying the known 2604:3d09 IPs or matching the four profiles identified from those geo events.
The compiled MERLIN/UofM sets include 2,354 UofM edge requests and 1,403 AS16796 MERLIN rows. The RRC local-prefix set contains 402 rows, including 401 requests from 198.163.150.16 on Apr 8. The updated route/session records include an Apr 8 RRC-scandal-page session from that address and browser/profile identifiers listed in the anchor coverage file.
The campaign summary reports 22 hits from one AS212238 address in the bearer-token event set. The token and profile joins are listed in the retained triage material.
Tyler emailed Shelby alleging that Treble had misrepresented MERLIN location information and UofM traffic records. He named MERLIN, RRC, and UofM page traffic as related concerns. These are allegations in Tyler's message; the same email set includes Treble's February correction about the separate exploit-path source attribution.
Tyler sent Stephanie Fair an email alleging that Treble's communications were misleading and inappropriate and asked for internal complaints. Stephanie acknowledged receiving his information and asked whether Shelby was assisting and whether Tyler was a current student or employee.
After Tyler confirmed he was a current student, Stephanie replied that she would look into the concerns in his emails and follow up. The retained thread contains her final review response on October 15, but no intervening HR update.
Later entries follow the retained telemetry and the University’s HR responses through October 2026, keeping network observations and attribution separate within the cited records.
geoEventsFull contains 27 events from eight 2604:3d09 addresses, all resolved in that export as AS6327. Four device profiles share an exact IP with those events. The Oct 5 focus address has five geo records and an exact-IP profile match classified Android/mobile/bot by the export.
Tyler followed up with Shelby on June 9. On June 12, Shelby replied that an HR process relating to the IT Director was underway and referred questions to HR. She separately offered to contact Student Advocacy about Tyler's medical withdrawal and tuition appeal.
Tyler wrote that he still had not received an HR update about David Treble. Shelby said she had little information and asked whether Tyler wanted her to relay a request for HR to provide an update. Tyler said he still wanted written communication and apologies and connected the complaint to his broader RRC concerns.
The five cfRecent exports contain 2,680 unique request events. Reported network totals include DataCamp 1,274, Shaw 751, Bell 388, and M247 243. The newest retained row is Oct 16 at 05:19:10Z.
Shelby said she would follow up with HR, that the Dev Club and Ubisoft matters were outside her office's scope, and that Tyler could file a formal RWLE complaint if he could identify specific Dev Club members and provide evidence. She said a Student Advocate could help with the complaint.
The address 2604:3d09:a17c:4e20:2f57:1873:9ecc:c466 has 156 Cloudflare rows in the recent exports and five geo events in the updated collection. A device profile matches by exact IP; two analytics page views and an /rrc-submission route are linked to the profile/time window. The security-collection records are not linked to this IP/profile.
Shelby wrote that she understood there was “no formal partnership between the University of Manitoba and Ubisoft,” reiterated that Ubisoft was outside her office's jurisdiction, and directed Tyler to an RWLE complaint for identifiable UofM individuals. The same date, Stephanie sent what she called final confirmation of her review: she found insufficient evidence of manipulation tactics and could not substantiate targeted racial abuse by individuals using UofM networks, adding that the University could not verify visitor identities.
In reply to Shelby, Tyler said an active human-rights complaint, File No. 26 EN 107, had been filed against the University and that he was separating the internal-staff and student-group complaint from issues involving external companies. The retained complaint form has that file number, but its filed-date and signature fields are blank; the record copy alone does not show the Commission's current processing status.
The three supplied research reports describe a Winnipeg technology community built around access: welcoming beginners, supporting underrepresented developers, providing mentorship, and connecting student work to industry. RRC, UofM, Ubisoft, the Dev Club, and the Winnipeg Game Collective appear as parts of that public-facing story. Inclusion is central to the image these reports describe.
Game CollectiveTyler’s reported connection
