BYOD ransomware gang claims Michigan State data theft

Claim, not confirmed. The BYOD ransomware gang added Michigan State University to its leak site on Sunday, November 1, saying it holds personal information on 1.3 million current and former students, The Record reported on November 2. Confidence in the figure: low. It is the gang’s number. No sample or independent check was reported.

What the university says

Confidence: moderate. This is the university’s account, given to The Record, and it is unverified externally.

Michigan State said it became aware of suspicious cyber activity in early October. IT required everyone with an MSU NetID to reset to a password of at least 15 characters. The notice went to campus on October 1.

A spokesperson called it “a potential credential compromise event.” Per the university, current evidence does not indicate a successful compromise of the central Active Directory environment. It also said there is no evidence other MSU data was accessed, changed, or stolen. The university did not answer follow-up questions about the leak-site post.

The gang

Confidence: moderate, single source. Everything below is as reported by The Record. None of it was independently confirmed in the material reviewed.

BYOD emerged in September. The Record says little is known about it.

• University of New Mexico: The Record reports BYOD attacked the school last week and shut down its hospital, and that ambulances had to be diverted. The group then apologized and, per the report, allegedly supplied decryption keys for free. The key handover is alleged, not confirmed.
• Trump Mobile: The Record reports an alleged attack last month and a leak of data on 3,615 customers. It says the leak drew Congressional scrutiny. The report names no member of Congress or committee, so the scope of that scrutiny is unconfirmed.

Michigan State was previously hit in 2020 by the Netwalker ransomware gang, per The Record. That is a separate and older incident.

Open questions

Whether the October credential event and the leak-site claim are the same intrusion: not established. Initial access method: not public. Whether any data left the university network: the school has not said.

Related: 3AM ransomware hit a UK school estate and the ransomware hub.