BYOD ransomware claims 1.3M student records — Michigan State University
Severity: medium · Patch status: no-fix-needed · Since 2026-11-02
The BYOD ransomware gang, which emerged in September 2026 and recently attacked the University of New Mexico hospital, added Michigan State University to its leak site on 2026-11-02, claiming theft of personal data on 1.3 million current and former students. MSU detected suspicious cyber activity in early October and on October 1 forced password resets for all NetID holders, requiring 15+ character passwords. The university says evidence indicates a potential credential compromise event but no successful compromise of its central Active Directory, and no evidence other MSU data was accessed, changed, or stolen. MSU previously suffered a Netwalker ransomware attack in 2020. The gang's claims remain unverified; MSU did not respond to follow-up questions.
What to do
- Force password resets and enforce strong password/length policies for all accounts, as MSU did
- Review authentication logs for credential compromise indicators, especially against Active Directory
- Monitor BYOD leak site claims and verify whether institutional data appears
- Harden MFA and conditional access for student and staff accounts
- Review incident response and ransomware playbooks given BYOD's recent healthcare-sector attacks
Sources
All live incidents on Threat Watch
