Key facts
- Michigan State University described the October activity as a potential credential compromise and said current evidence does not show a successful compromise of its central Active Directory environment.
- MSU said it has seen no evidence that additional university information was accessed, changed or stolen, and said its security controls work as designed.
- MSU had not issued a public statement directly replying to BYOD's claim at the time of publication.
- The university told users that new NetID passwords must contain no fewer than 15 characters.
The ransomware group BYOD claimed to hold personal details for more than 1 million current and former students at Michigan State University, a claim the university has not confirmed, and a leak-site listing naming the university was discovered on November 2, 2026.
Michigan State frames the October activity as a potential credential compromise and says current evidence does not show a successful compromise of its central Active Directory environment. The university said it has seen no evidence that additional university information was accessed, changed or stolen, and said its security controls work as designed.
On October 1, 2026, MSU IT required every NetID user to reset their password after suspicious cybersecurity activity was reported, and told users that new NetID passwords must contain no fewer than 15 characters. Amber McCann, a Michigan State University spokesperson, said the institution recently became aware of suspicious cyber activity and immediately began investigating the matter.
BYOD’s leak-site post gives 1.03 million current and former students, while The Record reports the claim as 1.3 million current and former students. The gap between the figures is 270,000, and 1.3 million exceeds 1.03 million by roughly 26 per cent.
Michigan State reported 50,941 students enrolled in fall 2026 as of October 5, 2026, meaning the claimed 1.3 million figure is about 25.5 times that enrollment and 1.03 million is about 20.2 times. The claim covers current and former students, so it spans many years of enrolment.
CTIWatch describes byod as a financially motivated ransomware-as-a-service group that steals sensitive data and threatens to release it publicly to force victims to pay ransoms. In October, a threat actor tied an alleged Trump Mobile breach involving 3,615 customers to BYOD, drawing Congressional scrutiny.
The group first gained wide notice by claiming an October 26, 2026 cyberattack on UNM Health that forced ambulance diversions and canceled clinic appointments throughout New Mexico. Reports said BYOD apologized for the hospital attack and promised free decryption keys for hospital devices while intending to retain data it says it stole.
The University of New Mexico said it gave in to no group behind the threat and told patients, students and staff to avoid anyone claiming responsibility. The Record reported on October 29 that the Health Sciences Center restored systems and paid no ransom, and that the group offered free decryption keys and to destroy stolen data if people contacted it and paid $2,500.
The leak-site listing was discovered at 03:50 UTC on November 2, 2026, about 31 days after the October 1 password-reset email. The university’s status incident opened at 4:50 PM EDT on October 1 and was shut as resolved at 10:48 AM EDT on October 30, 2026.
Michigan State had not issued a public statement directly replying to BYOD’s claim at the time of publication, and BYOD has released no proof backing the claimed haul size. Independent verification is lacking, and the threat-intelligence report lists no confirmed unauthorized access, compromised systems, stolen records or published data.
No ransom demand or negotiation details have been disclosed for the claim against Michigan State, and the ThreatMon report provides no affected-person count. No source says Michigan State systems were encrypted.
Michigan State is one of the largest schools in the U.S., with multiple graduate schools plus its undergraduate institution based in East Lansing. The university experienced a prior ransomware attack in 2020 carried out by the NetWalker ransomware gang.
That framing contrasts with MSU’s position that evidence of wider theft is lacking, and CTIWatch quotes BYOD’s leak-site text: “Full Personal Identifiable Information for 1.03 million current and ex students”. The university’s November 2 statement reads like the October 5 student newspaper statement, differing only by the word also and a comma, and the status page Resolved label set on October 30 says nothing about the investigation.
The tracker’s estimated attack date for MSU is November 1, matching the listing but not when anyone first got in, and the tracker lists BYOD’s UNM attack on October 26 and the MSU listing on November 1, six days apart. The IT Service Desk number listed on MSU’s status page is 517-432-6200 for users who cannot reset their password.
College and university IT often stitches together research systems, cloud platforms, identity tools and contracted support. Public victim listings can provide early warning, but they are not substitutes for forensic evidence. Both organizations could face reputational pressure even if the claims ultimately prove exaggerated. A victim appearing on a leak-site listing does not automatically establish that data was exfiltrated.
Join the discussion