Short answer
The BYOD ransomware gang listed Michigan State University on its leak site on 2 November 2026, claiming data on 1.3 million current and former students. MSU says it has not determined that personal information was compromised, and has not confirmed a link to the suspicious activity that led it to force password resets on 1 October.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Michigan State University |
|---|---|
| Incident type | Ransomware |
| Status | Claimed by attackers, unconfirmed |
| Sector | Higher education |
| Country | United States |
| Detected | 2026-10-01 |
| Disclosed | 2026-11-02 |
| People or records affected | Claimed by the attackers: data on 1.3 million current and former students. Not confirmed by MSU. |
What data was exposed
- Unconfirmed: the BYOD gang claims personal information on 1.3 million current and former students; the types of data it claims were not specified
- MSU says it has not determined that any personal information was compromised
What happened
On the evening of Sunday 1 November 2026, according to The Record, the ransomware gang calling itself BYOD added Michigan State University to its leak site. It claimed to have stolen personal information on 1.3 million current and former students. This post covers a claim, not a confirmed breach.
What MSU says
The university says the claims are tied to suspicious activity it detected in early October. On 1 October it emailed everyone with a NetID to reset their password, setting a new 15-character minimum. MSU described it as a possible credential compromise and said available evidence did not show a successful breach of its central Active Directory environment, nor any other MSU data accessed, changed or stolen.
The State News reported on 3 November that MSU IT is monitoring a potential threat with cybersecurity partners, law enforcement and the State of Michigan. Spokesperson Emily Guerrant said: “The investigation is ongoing, and MSU has not determined that any personal information was compromised.” MSU has not confirmed that the gang’s claim is linked to the October incident and was not aware BYOD was involved in it.
Neither outlet reported what kinds of data the gang says it holds, and the 1.3 million figure is unverified.
About the gang
The Record says BYOD emerged in September and little is known about it. It said the gang attacked the University of New Mexico the previous week, shutting down its hospital and diverting ambulances, and later apologized and allegedly provided decryption keys free. See our post on UNM Health. The Record also reported that the gang allegedly leaked data on 3,615 Trump Mobile customers last month, which drew congressional scrutiny. We have not independently verified that claim.
MSU was hit by the Netwalker gang in 2020.
Why password resets matter
A forced password reset after suspicious activity is the kind of step that can prevent a later incident. Even if the gang’s claim is exaggerated, reused passwords from other breaches are a common way into university accounts. A 15-character unique password and multi-factor authentication reduce that risk.
What students and staff should do
Reset your NetID password if you have not, do not reuse it, and watch for messages that appear to come from MSU IT. Gangs sometimes email individuals directly to pressure the institution, so treat any threat that names your data as a scam until MSU says otherwise. Our guide to phishing messages and our data breach checklist cover the next steps if MSU later confirms a breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as MSU IT that ask for your NetID and password to 'secure' your account.
- Extortion emails or texts that quote the news and threaten to leak your records.
- If a leak is confirmed, scams that use real student details such as financial aid, tuition or housing.
What to do if you are affected
- 01Reset your NetID password to a unique one of at least 15 characters if you have not since 1 October, and do not reuse it elsewhere.
- 02Treat any message asking for your NetID credentials as suspect and use MSU's official sites, not links in email.
- 03Ignore and report threats that claim to hold your data and demand payment.
- 04Watch for an official MSU notice. Until one arrives, treat the gang's figures as a claim, not a finding.
- 05Consider a credit freeze if MSU later confirms that sensitive personal data was taken.
Frequently asked questions
Did Michigan State University confirm a data breach?
No. A spokesperson said the investigation is ongoing and MSU has not determined that any personal information was compromised. MSU did not say whether the group stole data on 1.3 million students.
What is the October password reset about?
On 1 October MSU emailed staff and students to reset their NetID passwords after suspicious activity, with a new minimum length of 15 characters. MSU described it as a possible credential compromise and said evidence did not show a successful breach of its central Active Directory.
Is the gang's claim linked to the October activity?
MSU says it has not confirmed that the current threat is connected to last month's incident and was not aware BYOD was involved in it. The Record reports that MSU tied the gang's claims to the October activity, so the link remains unresolved.
Who is the BYOD gang?
The Record says the gang emerged in September and little is known about it. It has also claimed the attack that shut down a University of New Mexico hospital, and a leak of Trump Mobile customer records.
Sources
- Ransomware gang that attacked hospital claims cyber incident at Michigan State University, The Record, 2026-11-02
- MSU monitors cybersecurity threat after hackers claim responsibility, The State News, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.