Overview
The ransomware group BYOD listed Michigan State University (MSU) on its leak site on the evening of Sunday, November 1, 2026, claiming to have stolen personal information on 1.3 million current and former students. The listing appears to match a security incident that prompted campus-wide action at MSU earlier in the fall.
MSU's Account
MSU detected suspicious cyber activity in early October and emailed the campus community on October 1, requiring every account with an MSU NetID to reset its password to a new one of at least 15 characters.
The university says the activity looks like a possible credential compromise. It says current evidence does not show a successful breach of its central Active Directory environment, and it has found no indication that other MSU data was accessed, changed, or stolen. MSU did not respond to follow-up questions about the gang's claims, and the 1.3 million figure is unverified.
MSU was previously hit by a Netwalker ransomware attack in 2020.
About BYOD
BYOD emerged in September 2026 and little is publicly known about it. Its recent activity:
- University of New Mexico (October): An attack shut down the university hospital and forced ambulance diversions. The group later apologized and allegedly provided decryption keys for free.
- Trump Mobile (October): The group allegedly leaked data on 3,615 customers, which drew congressional scrutiny.
Takeaways
- Credential-based intrusions remain the common thread. Enforce MFA on all student, staff, and admin accounts, and monitor for impossible-travel and anomalous sign-ins.
- Mass password resets are a containment tool, not a conclusion. Pair them with session revocation, token invalidation, and review of mailbox rules and OAuth grants.
- Treat leak-site claims as unverified, but act on them. Check logs for exfiltration, and prepare notification plans in case the claim holds.
- Education and healthcare sectors are active targets. Verify offline backups and test restoration of critical systems.