VULNpocalypse
HighBreach / campaignMonitoring

Michigan State University is investigating a cyber incident after the BYOD ransomware gang listed it on its leak site

MSU is investigating a potential credential compromise found in early October. The new BYOD gang claims 1.3M student records; MSU has not confirmed it.

Published
Exploitation
N/A

What happened

  • Early October 2026: MSU says it “became aware of suspicious cyber activity and immediately began investigating the matter” and that, based on the investigation to date, the activity “appeared to be a potential credential compromise event” (The Record).
  • 1 October 2026: MSU sent a campus email requiring everyone with an MSU NetID to reset their password, with a new minimum length of 15 characters (The Record).
  • Sunday evening (reported 2 to 3 November 2026): the BYOD ransomware gang added MSU to its leak site and claimed to have stolen personal information on 1.3 million current and former students. The Record does not verify this claim, and MSU did not respond to follow-up requests about the hackers’ assertions (The Record).

The BYOD group’s leak-site posts are also tracked by RansomLook, which catalogs ransomware leak-site listings; a listing there records the group’s own post and is a claim, not independent confirmation.

What we know / don’t know

Confirmed by MSU (via The Record):

  • MSU is investigating suspicious cyber activity first noticed in early October (The Record).
  • MSU characterizes the activity as a “potential credential compromise event” (The Record).
  • MSU states current evidence does not show a successful breach of its central Active Directory environment, and that “There is no evidence that other MSU data was accessed, changed, or stolen” (The Record).
  • MSU required a campus-wide NetID password reset with a 15-character minimum, emailed on 1 October 2026 (The Record).

Claimed by the BYOD group, not confirmed:

  • That it stole personal information on 1.3 million current and former students. This is the gang’s own assertion on its leak site. The Record did not verify it, and MSU did not respond to questions about it (The Record).

About BYOD:

  • BYOD is a new ransomware gang that emerged in September 2026, and little is known about it (The Record).
  • The week before the MSU listing, BYOD attacked the University of New Mexico and shut down its hospital, forcing ambulances to be diverted; the group later apologized and allegedly provided decryption keys for free (The Record).
  • The previous month, BYOD allegedly attacked Trump Mobile and leaked data on 3,615 customers, which drew Congressional scrutiny (The Record).

Open questions:

  • Whether the 1.3 million-student figure or any data theft is real, and if so, what categories of personal information are involved. MSU’s public statements to date do not confirm data exfiltration.
  • Whether this incident is connected to the credential compromise MSU is investigating, or a separate claim. The Record does not establish a link beyond the timing.
  • MSU’s 2020 ransomware attack was attributed to the Netwalker gang; The Record does not connect it to BYOD (The Record).

Sources