The BYOD ransomware gang has listed Michigan State University on its leak site, claiming to hold personal information on more than 1 million current and former students. The listing appeared on Sunday evening, November 1, 2026, about a month after MSU forced every NetID user to reset their password following what it called suspicious cybersecurity activity.
MSU has described the October event as a potential credential compromise. It has not called the incident ransomware and has not confirmed that any student data was stolen. The gang’s claims have not been independently verified.
What BYOD says it took from MSU
In its leak-site post, the group claims to have “full” personal information on 1.03 million current and former students, along with data on university staff. Some early reports have rounded the figure to 1.3 million. BYOD also alleges that it holds current and former passwords and has a “full compromise” of MSU systems, and it urged the university to make contact, warning it not to “let it scale any further.”
BYOD has not published proof that supports the size of the alleged haul, and BreachNews has not reviewed any data tied to the claim. A threat actor’s record count is often inflated to put pressure on a victim during extortion talks.
MSU’s October password reset
On October 1, 2026, MSU IT emailed all students, faculty and staff to say it was requiring a password reset for every MSU account while it investigated suspicious cybersecurity activity. New NetID passwords must be at least 15 characters long. After the reset, users had to sign in again to Microsoft 365, email, Teams, VPN services and other systems such as D2L, SIS and EBS.
The notice said there was “no evidence of malware, data corruption, or unauthorized activity within individual MSU accounts” and that “there is no evidence that other MSU data has been accessed, changed, or stolen.” MSU also recommended that users set up the Okta Verify app as their preferred sign-in method. The related incident on the MSU Service Status page was marked resolved on October 30.
How the university describes the incident
MSU spokesperson Amber McCann told The State News that the university “recently became aware of suspicious cyber activity and immediately began investigating the matter.” According to the student newspaper, the activity was focused on gaining access to user login information.
The university has since tied the leak-site claim to that early October event. In its statements, MSU said:
- The activity appeared to be a potential credential compromise event.
- Current evidence does not indicate a successful compromise of the university’s central Active Directory environment.
- There is no evidence that other MSU data was accessed, changed or stolen.
- Its security measures continue to function as designed.
MSU had not issued any public statement responding directly to BYOD’s 1 million student record claim at time of publication.
The same gang claimed the UNM Health attack
BYOD is a newer group that surfaced in September 2026. It drew wide attention after it claimed responsibility for the October 26 UNM Health cyberattack that diverted ambulances and canceled clinic appointments across New Mexico. According to multiple reports, the group later apologized for hitting a hospital and said it would hand over decryption keys for hospital devices, while still keeping data it claims to have stolen.
The University of New Mexico said it made no concessions to any group behind the threat and warned patients, students and staff not to engage with anyone claiming responsibility, including people offering payments or compensation. UNM said the incident remains under criminal investigation.
BYOD’s name also came up in October when a threat actor attributed an alleged Trump Mobile breach affecting 3,615 customers to the group.
Why a credential event still matters
Even if MSU’s core directory was not breached, stolen NetID logins can open doors to email, cloud storage and student systems that hold sensitive records. That is why large universities are frequent targets, as seen in the Instructure breach claimed by ShinyHunters and the ransomware attack on the University of Illinois Chicago College of Medicine. MSU itself was hit by the NetWalker ransomware gang in 2020.
What MSU students and alumni can do now
- Make sure your NetID password was reset after October 1 and is not reused on any other site.
- Set up Okta Verify as your main sign-in method, as MSU IT recommends.
- Change any personal account that shared an old MSU password, and check whether your email or password appears in a known breach.
- Do not respond to anyone who contacts you claiming to be behind the incident, and be wary of emails or texts that mention it and ask for logins or payment.
- Watch for official notices from MSU before taking further steps, such as a credit freeze.
BreachNews will update this story if MSU confirms whether any student or staff data was taken.
