A new ransomware gang says it stole personal information on 1.3 million current and former Michigan State University students. The group, known as BYOD, added the university to its leak site on the evening of Sunday 1 November 2026, according to The Record from Recorded Future News. The claim has not been verified, and the university has not confirmed that any student data was taken.

What Michigan State has confirmed is a security incident a month earlier. The university told The Record it became aware of suspicious cyber activity in early October and began investigating at once. On 1 October its IT team emailed every student, faculty member and staff member and required them to reset their MSU NetID password, choosing a new password at least 15 characters long.

What the university has, and has not, confirmed

A university spokesperson described the October activity as appearing to be a potential credential compromise event, focused on user login information. The spokesperson said current evidence does not indicate a successful compromise of the university's central Active Directory environment, and that there is no evidence other university data was accessed, changed or stolen.

The university did not answer follow-up questions about the specific claims in the gang's leak-site post. That leaves the two accounts unconnected in public: Michigan State has confirmed someone went after logins, while BYOD says it walked away with student records. Nothing published so far proves the leak-site post describes the same incident the university investigated in October, and no ransom demand or deadline has been reported.

A new gang with a noisy first month

BYOD emerged in September 2026 and little is known about the group. Its higher-profile incident came on Monday 26 October, when the University of New Mexico Health Sciences Center identified a threat and began containment. The hospital cancelled scheduled appointments and outpatient surgeries that day, diverted ambulances to other hospitals for about two hours, and cancelled classes at its medical, nursing, pharmacy and population health colleges.

On its leak site BYOD claimed to have compromised 36,000 systems across the New Mexico campus and hospital, including Active Directory forests, the full Microsoft Entra tenant and two Oracle databases, and said it held Social Security numbers, payroll and student records, internal emails, research data and patient information. The Health Sciences Center pushed back, saying the event affected some end-user devices but did not penetrate core systems or servers, and that it made no concessions to any group. The group then posted apologies, said it would hand over decryption keys for healthcare systems for free, and offered to destroy individuals' information if they contacted it directly and paid 2,500 dollars. The university warned patients, students and staff not to engage with anyone claiming responsibility, saying attackers may follow up with scams including false offers of payment.

The Record also reports that BYOD allegedly leaked data on 3,615 Trump Mobile customers in October. Michigan State itself dealt with a NetWalker ransomware attack in 2020. Students, alumni and staff should reset any MSU NetID password not changed since 1 October, change the same password anywhere else it was used, and treat any message asking for a password or an Okta code as a scam, since the university will not ask for those by email, text or phone.