Michigan State cyber incident claimed by ransomware gang behind recent hospital attack

Michigan State University officials said recent claims by a ransomware gang were tied to an incident last month that forced password resets for all student and employee accounts. 

On Sunday evening, the BYOD ransomware gang added the university to its leak site — claiming to have stolen personal information on 1.3 million current and former students. Last week, BYOD caused outrage after attacking The University of New Mexico and shutting down its hospital. 

A spokesperson for Michigan State told Recorded Future News that the university “became aware of suspicious cyber activity and immediately began investigating the matter,” in early October.  

To protect university accounts and systems, the school’s IT team required anyone with an MSU NetID to reset their passwords and create a new password that is at least 15 characters long. The email was sent out to campus on October 1.

“Based on the investigation to date, the activity appeared to be a potential credential compromise event. Current evidence does not indicate a successful compromise of the university's central Active Directory environment,” a spokesperson said. 

“There is no evidence that other MSU data was accessed, changed, or stolen, and the university's security measures continue to function as designed.”

The university did not respond to follow-up requests for comment about the claims made in the hackers' post. 

Michigan State is one of the largest schools in the U.S., with multiple graduate schools in addition to its undergraduate institution based in East Lansing. It previously dealt with a ransomware attack in 2020 by the Netwalker ransomware gang.

In the University of New Mexico incident, ambulances had to be diverted before the group apologized and allegedly provided decryption keys for free.  

BYOD is a new ransomware gang that emerged in September and little is known about the group. The group drew headlines after an alleged attack on Trump Mobile last month and subsequent leak of data from 3,615 customers drew Congressional scrutiny.