Michigan State University (MSU) has confirmed that a ransomware gang's claims are tied to a cyber incident it found in early October. That incident led the university to force a password reset for every student, faculty and staff account. The BYOD ransomware gang added MSU to its leak site on November 1. It claims to hold personal information on more than a million current and former students, though the figure varies by report. The Record puts it at 1.3 million. A capture of the leak post indexed by the tracker Breach House, and a HookPhish report cited by ClassAction.org, both say 1.03 million. MSU has not confirmed that any data was stolen. Last week the same gang attacked the University of New Mexico and shut down its hospital.
What Happened
An MSU spokesperson told The Record that the university "became aware of suspicious cyber activity and immediately began investigating the matter" in early October. On October 1, MSU IT posted a notice requiring everyone with an MSU NetID to reset their password to a new one of at least 15 characters "while suspicious cybersecurity activity is investigated." The notice said there was "no evidence of malware, data corruption, or unauthorized activity within individual MSU accounts" and called the reset a precaution.
The university's current position, as given to The Record, is that "the activity appeared to be a potential credential compromise event." It also says that "current evidence does not indicate a successful compromise of the university's central Active Directory environment." The spokesperson added that there is "no evidence that other MSU data was accessed, changed, or stolen." MSU did not answer The Record's follow-up questions about the details in the gang's post.
According to ClassAction.org, the dark web monitoring site Ransomware.live listed the claim on November 2 and estimated the attack date as November 1. Breach House shows the leak site listing dated November 1 and indexed November 2, with the leak status marked "pending." That usually means no data has been published yet. Plaintiff attorneys working with ClassAction.org have already started taking inquiries from MSU students and staff.
MSU has been hit before. The Netwalker ransomware gang attacked the university in 2020.
What Was Taken
Only the attackers' word is available so far. The leak post, as captured by Breach House, claims "Full Personal Identifiable Information for 1.03 million current and ex students as well as the full team in relations to MSU." It also claims "current and ex passwords." The Record reported the total as 1.3 million. Readers should treat 1.03 million to 1.3 million as the range of the claim, not a verified count.
If the password claim is true, it matters most. It would fit MSU's own description of a credential compromise, and it would explain the campus-wide reset. MSU has not said what kinds of data, if any, were taken. No breach notification letters have been reported and no regulator filing has been published.
Michigan law doesn't make the timing of disclosure clear. Under MCL 445.72, organisations must notify affected Michigan residents "without unreasonable delay." There is no fixed deadline, and no notice to the Attorney General or any state agency is required. The credit bureaus must be told only if more than 1,000 residents are notified. Notice can be skipped if the organisation decides the breach is unlikely to cause substantial loss, injury or identity theft. A knowing failure to notify carries a civil fine of up to $250 per failure, capped at $750,000 per breach. Senate Bills 360 to 364 would add a 45-day deadline and require notice to the Attorney General. They passed the state Senate in August 2025 but have not passed the House, so they are not law.
Why It Matters
BYOD is a new group, and it is targeting large public institutions with sensitive data and little tolerance for downtime. The Record reports that in the University of New Mexico attack, ambulances had to be diverted. The group then apologised and allegedly handed over decryption keys for free. The hospital attack caused outrage, but the MSU listing shows it has not made the group back off.
Universities are easy targets for this kind of operation. Huge numbers of people hold accounts, including alumni and former staff, records are kept for a long time, and login systems are spread across Microsoft 365, VPN, learning platforms and student information systems. MSU's reset notice lists all of these. One set of stolen login details can open a lot of doors.
There is also a gap between the two stories. MSU says it found no evidence of data theft and that its central directory was not compromised. The gang says it has personal data and passwords for over a million people. Both can be true at once. Data can be stolen through compromised accounts without the attacker ever reaching Active Directory. Until the gang publishes data or MSU finishes its investigation, accounts differ.
One unrelated local event should not be confused with this one. In late October, MSU Federal Credit Union, a separate organisation, briefly took its website and apps offline. WILX reports this was a precaution against a widely reported PHP vulnerability. The credit union says it saw no sign that member information was compromised. Nothing reported links that shutdown to the BYOD claim.
The Attack Technique
How the attackers got in has not been disclosed. MSU calls it a "potential credential compromise event." Its response points the same way: a forced reset for all users, a new 15-character minimum, and a push to move people from Okta SMS codes to the Okta Verify app.
Stealing login details and sessions has become cheap and easy to rent, which is useful context here. In September, The Hacker News described a phishing service called NovaCookies, which rents for $320 a month. It sits between the victim and the real Microsoft 365 login page and relays the sign-in in real time. That lets it steal the logged-in session even when the user enters the correct password and second factor. Researchers say it runs on at least 755 domains, and more than half the affected organisations are in or connected to the United States. There is no evidence tying NovaCookies or a similar service to the MSU incident. The point is that a password reset alone may not lock out an attacker who already holds valid sessions. Breach House's description of BYOD as linked to "mobile and personal device-related intrusion patterns" looks like an inference from the group's name, not reported evidence.
What Organizations Should Do
- Revoke sessions, not just passwords. After a suspected credential compromise, invalidate all active sessions and refresh tokens across your identity provider, Microsoft 365 and VPN. A stolen session can survive a password change.
- Retire SMS and voice codes for phishing-resistant MFA. Move users to phishing-resistant methods such as FIDO2 security keys or passkeys, or at minimum to app-based push with number matching. Be aware that app prompts can still be relayed by phishing kits like the one described above.
- Clean up old accounts. The gang claims "ex" students, staff and passwords. Disable or tightly restrict accounts for alumni, former employees and inactive users, and purge old password records you don't need.
- Watch for misuse of valid logins. Alert on impossible travel, new devices or locations reusing an existing session, unusual mailbox rules, and bulk downloads from student information systems and file shares.
- Prepare your notification plan now. Michigan's "without unreasonable delay" standard gives no fixed clock, but other states' laws apply to their residents. Map where your affected people live before you need to send letters.
- Warn your community about follow-on phishing. If a leak goes public, students and staff will be targeted with convincing phishing. Tell them in advance what official messages will and won't look like.
Sources: Michigan State cyber incident claimed by ransomware gang behind rec... | Michigan State University Data Breach? Attorneys Investigate Reports | Required Password Reset for All MSU Accounts | Michigan State University — BYOD Ransomware Attack Breach House | Michigan Data Breach Notification Law: MCL 445.72 | Michigan Data Breach Notification Law: 2026 Rules | Expert: MSUFCU’s website shutdown was a sign security worked, not a... | The Login Worked. That Was the Attack.