A two-month-old gang just named a Big Ten university
Michigan State University disclosed in early October that it was investigating suspicious cyber activity, and on October 1 it forced every person with an MSU NetID to reset their password to a string of at least 15 characters. The university described the incident as a potential credential compromise and said it found no evidence that other university data had been accessed, changed, or stolen. That carefully worded statement held until this past Sunday, when a ransomware gang calling itself BYOD added Michigan State to its leak site and claimed to have exfiltrated personal information belonging to 1.3 million current and former students, faculty, and staff.
Michigan State has not confirmed the figure, and a spokesperson told The Record that current evidence does not indicate a successful compromise of the university's central Active Directory environment. That is the right statement to make while an investigation runs, but it is worth noting what it does not say: it does not say the 1.3 million figure is wrong, and it does not say no data left the building. For a CIO watching from outside, the gap between a university's forensic timeline and a criminal group's leak-site claim is exactly where the next two weeks of this story will play out.
This is not BYOD's first target, and the pattern should worry you
BYOD emerged only in September 2026, and in under two months it has already attacked a hospital system and a telecom carrier before turning to higher education. Its most consequential attack to date hit the University of New Mexico's hospital network, where the disruption was severe enough to divert ambulances away from affected facilities in real time. The gang later apologized for that attack and allegedly handed over decryption keys for free, an unusual move that suggests either a crew with some remaining scruples about patient safety or one that calculated the reputational cost of a dead patient outweighed the extortion payout.
Weeks later, BYOD claimed an attack on Trump Mobile, leaking data tied to 3,615 customers, a breach small enough in raw numbers to be almost a footnote except that it drew Congressional attention within days because of who the customers were. Three very different victims, hospital, carrier, university, in under sixty days is not the profile of a crew still finding its footing. It is the profile of a group that has figured out initial access works across sectors and is testing how large a victim it can take on before anyone meaningfully disrupts it.
Why higher education keeps losing this fight
Universities carry a specific structural weakness that BYOD and groups like it are built to exploit: enormous, loosely federated identity systems that have to serve students, faculty, alumni, contractors, and research partners simultaneously, often across decades of accumulated accounts. A NetID at a school the size of Michigan State is not a tidy corporate directory. It is closer to a small country's population register, built up over generations of enrollment, employment, and vendor access that nobody has fully audited in years. A credential compromise in that environment does not need to touch Active Directory to be damaging. It only needs to touch the sprawl of downstream systems, financial aid portals, health records, HR databases, that trust a valid NetID without re-verifying intent.
This is also why the university's own statement, careful as it is, should not be read as reassurance by peer institutions. Not finding evidence of AD compromise in the first weeks of an investigation is not the same as ruling out data loss elsewhere in the identity graph. Every large organization with a similarly sprawling, decades-deep identity system, not just universities, should read MSU's forensic timeline as a preview of their own blind spots rather than a university-specific problem.
What a forced password reset does and doesn't buy you
Michigan State's response, a mandatory 15-character password reset across the entire NetID population, is a reasonable first move and the kind of action that looks decisive in a press statement. It is also a blunt instrument. A password reset addresses credentials that were stolen through phishing or reuse, but it does nothing for data that was already exfiltrated before the reset, and it does nothing for session tokens, API keys, or service accounts that weren't tied to a human password in the first place. If BYOD's claimed 1.3 million records are real, they were almost certainly copied before anyone at MSU typed a new password.
This matters for how enterprise security teams should calibrate their own incident playbooks. A credential reset is necessary but it is not remediation, and treating it as the headline response risks giving leadership a false sense that the incident is closed. The more important question, one Michigan State and every organization in its position needs to answer quickly, is what the compromised credentials had access to before they were rotated, and whether logging exists to reconstruct that access with any confidence.
The roadmap implication for CIOs who hold large member populations
If your organization sits on a large, long-lived identity population, students, loyalty program members, patients, policyholders, treat a new ransomware brand's first few claimed victims as a signal worth tracking even before attribution is solid. BYOD's trajectory from hospital to telecom to university in under two months shows these groups scale their targeting faster than most enterprise threat models assume a brand-new actor will. Waiting for a group to build a reputation before taking its claims seriously means you are always one victim behind.
Concretely, that means auditing how much of your downstream access depends on a single identity credential without re-verification, inventorying service accounts and API keys that a password reset would not touch, and pressure-testing whether your logging would let you answer, within days rather than weeks, exactly what a compromised account touched before it was locked down. Michigan State's statement that current evidence shows no AD compromise is good news if it holds. It is not, on its own, an answer to the harder question every leader in this position needs to ask: what could have left before we knew to look.
