BYOD claims theft of 1.03 million records at Michigan State
The BYOD gang listed Michigan State University on its leak site, claiming theft of personal data on 1.03 million current and former students and staff, including passwords and continued access to systems. The university confirmed suspicious activity in early October, calls it a potential credential compromise, and says there is no evidence data was stolen. All NetID accounts were forced to reset passwords on October 1; the investigation continues.
What happened
The BYOD ransomware gang claims it stole data on 1.03 million current and former Michigan State University students and staff, including current and old passwords. The university confirms suspicious activity in early October and reset all account passwords, but says there is no evidence any data was stolen.
Why it matters
If confirmed, the breach exposes personal data and passwords of nearly the entire current and former university community, a direct target for fraud and phishing. The incident already forced campus-wide measures and carries regulatory and reputational risk.
What to do
Confirm every NetID account completed the password reset (minimum 15 characters) and watch for anomalous access, since the gang claims continued access to systems.
For the technical team
- Affected
- Michigan State University; alegado roubo de dados pessoais de 1,03 milhão de estudantes e servidores atuais e antigos, incluindo senhas atuais e antigas, com acesso contínuo aos sistemas reivindicado · MSU NetID accounts of current and former students and staff; claimed data includes personal information and current and former passwords. No specific product or version cited.
- Exploitation
- Public claim by the BYOD gang on its leak site, added Sunday evening, according to The Record. The university does not confirm data theft and did not respond to the claim of continued access.
- Fix
- No patch applicable. Mitigation adopted by the university: mandatory password reset for everyone with a NetID, minimum 15 characters, announced to campus on October 1.
- Vector
- The university describes the case as a potential credential compromise and says current evidence does not indicate a successful compromise of the central Active Directory environment. The initial vector is not detailed in the sources. The gang alleges continued access to systems.
- More details
- The Record reports the claim as 1.3 million people; the gang's post, quoted by Dark Web Informer, says 1.03 million and includes current and former passwords and continued access. AlvieriD estimates 1 million current and former students and 600,000 living alumni. BYOD emerged in September; it previously attacked the University of New Mexico hospital, with ambulances diverted, and allegedly provided free decryption keys after apologizing; it claimed an attack on Trump Mobile with a leak of data on 3,615 customers, drawing Congressional scrutiny. MSU previously suffered a Netwalker ransomware attack in 2020.
Timeline
The Record reports the BYOD post appears to line up with a security incident that prompted campus-wide action at the university.
New BYOD claim puts the toll at 1.03 million students and personnel, adds current and former passwords and alleges continued access.
Incident opened.
Sources 3 sources
- @AlvieriD @AlvieriD
- @DarkWebInformer @DarkWebInformer
- Michigan State cyber incident claimed by ransomware gang behind recent hospital attack The Record
