BYOD Claims Michigan State Data Theft After Suspected Credential Compromise

The BYOD ransomware gang listed Michigan State University on its leak site, claiming to have stolen personal information belonging to current and former students. Reports differ on the claimed scale: The Record cited 1.3 million students, while BreachNews cited 1.03 million and additional claims involving staff data and passwords. The theft claims remain unverified, and BYOD has not published evidence substantiating the alleged volume of stolen records.

Michigan State linked the claims to suspicious activity detected in early October, which it described as a potential credential compromise, not a confirmed ransomware incident. The university required password resets for all student and employee NetID accounts and said current evidence did not indicate a successful compromise of its central Active Directory environment or access to, alteration of, or theft of other university data. MSU marked the related service-status incident resolved on October 30 and recommended Okta Verify as users’ preferred sign-in method. The university did not answer The Record’s follow-up questions about the leak-site post.