Sensitive physics and engineering research at US and Canadian universities may have been exposed after hackers used Roundcube flaws to enter mail servers.