---
title: BYOD ransomware gang lists Michigan State University, claiming data on 1.3 million students; MSU says an early-October credential incident forced campus-wide password resets but it has no evidence data was stolen | ctxsec
url: https://ctxsec.com/items/michigan-state-byod-ransomware-claim-1-3m-students-oct-credential-incident
description: "The BYOD ransomware gang, the same group that hit the University of New Mexico and its hospital last month, added Michigan State University to its leak site on Sunday, claiming personal information on 1.3 million current and former students. MSU told Recorded Future News it detected suspicious activity in early October, required every NetID holder to reset to a password of at least 15 characters on Oct 1, and that the evidence so far shows a possible credential compromise with no successful compromise of its central Active Directory and no sign data was accessed or stolen. The gang's claim has not been verified."
status: "official in part (MSU spokesperson statement to Recorded Future News, Nov 2; Oct 1 forced password reset); the BYOD gang's 1.3 million-record theft claim is unverified"
published: 2026-11-02
---

> The BYOD ransomware gang, the same group that hit the University of New Mexico and its hospital last month, added Michigan State University to its leak site on Sunday, claiming personal information on 1.3 million current and former students. MSU told Recorded Future News it detected suspicious activity in early October, required every NetID holder to reset to a password of at least 15 characters on Oct 1, and that the evidence so far shows a possible credential compromise with no successful compromise of its central Active Directory and no sign data was accessed or stolen. The gang's claim has not been verified.

[← Cybersecurity News](/news) · [markdown](/items/michigan-state-byod-ransomware-claim-1-3m-students-oct-credential-incident.md)

official in part (MSU spokesperson statement to Recorded Future News, Nov 2; Oct 1 forced password reset); the BYOD gang's 1.3 million-record theft claim is unverified

2026-11-02

### BYOD ransomware gang lists Michigan State University, claiming data on 1.3 million students; MSU says an early-October credential incident forced campus-wide password resets but it has no evidence data was stolen

- **Confirmed by MSU:** suspicious activity in early October; a campus-wide forced password reset (minimum 15 characters) emailed Oct 1; investigation points to a potential credential compromise; no evidence the central Active Directory was compromised or that other data was accessed, changed or stolen.
- **Claimed, not verified:** BYOD's leak-site post says it took personal data on 1.3 million current and former students. MSU did not respond to follow-up questions about the claim.
- **Context:** BYOD appeared in September; in the University of New Mexico attack ambulances were diverted before the group apologized and reportedly handed over decryption keys.

MSU students and alumni should expect targeted phishing that cites the incident; don't reuse the old NetID password anywhere.

Sources: [Recorded Future News: Michigan State cyber incident claimed by ransomware gang (Nov 2)](https://therecord.media/michigan-state-university-byod-gang-cyber-incident)