Ransomware · Incident Response
Michigan State University faces ransomware claim after campus-wide password reset
A ransomware gang claims to have stolen data on 1.3 million people from Michigan State University, prompting a campus-wide password reset. The university says there is no evidence of a major breach so far.
Ross Grant2 min read
The short version
A ransomware group says it stole information on 1.3 million people from Michigan State University. The university made everyone reset their passwords after finding suspicious activity. So far, MSU says it has not found proof that sensitive data was actually stolen. The group behind this also attacked a hospital recently.
By the numbers
- 1.3 millionnumber of people the ransomware gang claims to have stolen data onRecorded Future News
- 15 charactersminimum new password length required for all MSU accountsRecorded Future News
What happened?
A ransomware gang called BYOD claimed responsibility for a cyber incident at Michigan State University. The gang says it stole personal data on 1.3 million current and former students. The university forced a campus-wide password reset in early October after detecting suspicious activity. MSU says there is no evidence so far that sensitive data was accessed or stolen.
Who is affected
Michigan State University (MSU) required all students and employees to reset their passwords after a security incident in early October. The university has over 1.3 million current and former students, according to the ransomware gang's claim. MSU is one of the largest universities in the United States, with a large campus and multiple graduate schools.
What was taken
On Sunday evening, the BYOD ransomware gang added MSU to its leak site and claimed to have stolen personal information on 1.3 million people. The university has not confirmed that any data was actually stolen. In a statement to Recorded Future News (opens in a new tab), a spokesperson said there is no evidence that other MSU data was accessed, changed, or stolen. The university did not respond to follow-up questions about the hackers' claims.
How the attack worked
MSU said it became aware of suspicious cyber activity in early October and began investigating. The university's IT team required anyone with an MSU NetID (the campus login) to reset their password to one at least 15 characters long. This action was taken to protect accounts and systems. According to the university, the incident appeared to be a potential credential compromise event. This means attackers may have obtained usernames and passwords, but current evidence does not show a successful compromise of the university's central Active Directory environment (the main system for managing logins and permissions).
The response
The university responded quickly by forcing a password reset for all accounts. This is a standard step when there is a risk that login credentials have been stolen. MSU said its security measures continue to function as designed. The university has not confirmed the ransomware gang's claim or said whether it has contacted law enforcement or regulators. There is no public evidence yet of data being leaked or used.
Has this happened before?
MSU previously faced a ransomware attack in 2020 by a different group, Netwalker. The BYOD gang, which claimed responsibility for the latest incident, is new and first appeared in September. The same group recently attacked the University of New Mexico, causing hospital disruptions and drawing national attention.
Claimed vs confirmed
- Unconfirmed
BYOD ransomware gang stole data on 1.3 million people from MSU.
BYOD made this claim on its leak site, but MSU has not confirmed that data was stolen.
Why it matters
Universities hold large amounts of personal data and are frequent targets for ransomware. Even when a breach is not confirmed, a claim by a ransomware gang can cause disruption and worry for students and staff. Forced password resets are a sign of possible credential compromise.
Key points
- A ransomware gang claims to have stolen data on 1.3 million people from MSU.
- The university forced a password reset for all students and staff.
- MSU says there is no evidence yet that sensitive data was stolen.
- The BYOD gang is new but has already attacked other major institutions.
- Universities remain a common target for ransomware groups.
Sources
Recorded Future News
Reference
