BYOD Ransomware Gang Claims 1.3 Million Records Stolen from Michigan State University

The BYOD ransomware gang listed Michigan State University on its dark web leak site over the weekend, alleging the theft of personal information belonging to 1.3 million current and former students. The claim follows a security event in early October that prompted university administrators to force a mandatory password reset for all holders of the school’s central login identifier, the MSU NetID.

While the threat actor claims a massive data exfiltration event, university officials have stated that the incident appears to be a credential compromise event that did not breach the central Active Directory environment or lead to confirmed data theft from core systems.

Scope of the Incident and Official Response

University IT teams detected suspicious cyber activity in early October and immediately launched an incident response investigation. To contain potential lateral movement and credential abuse across university systems, administrators issued a campus-wide directive on October 1 requiring all users with an MSU NetID to reset their passwords to a string at least 15 characters long.

According to university spokespeople, current forensic evidence indicates that the threat actors did not achieve administrative compromise of Michigan State’s central Active Directory infrastructure. University defenders reported no direct evidence that central database stores were altered, accessed, or exfiltrated. However, the university did not provide follow-up clarification regarding the specific claims made on BYOD’s leak site regarding the 1.3 million student records.

Michigan State is no stranger to extortion attacks, having previously suffered an incident involving the Netwalker ransomware gang in 2020. As one of the largest higher education institutions in the United States, operating extensive graduate programs alongside its primary East Lansing undergraduate campus, the university represents a high-density environment for identity assets and sensitive data.

Threat Actor Profile: The BYOD Ransomware Group

BYOD is a relatively new threat group that first surfaced in September 2024. Despite its recent emergence, the group has engaged in high-profile extortion campaigns across multiple sectors, relying heavily on public attention and disruptive tactics to compel victim payments.

The group drew initial scrutiny following an alleged attack on Trump Mobile, which resulted in the exposure of data belonging to over 3,600 customers and sparked Congressional inquiry. More recently, BYOD targeted The University of New Mexico (UNM), causing severe operational disruptions that forced the university’s healthcare system to temporarily divert incoming emergency ambulances. In an unusual turn following public backlash over the UNM hospital disruption, the group published a public apology and purportedly provided decryption keys without cost.

BYOD typically operates via a double-extortion model: obtaining initial access through compromised credentials or perimeter vulnerabilities, exfiltrating unencrypted sensitive data, and threatening public release if financial demands are not met. Their rapid pivot between high-value targets in education, healthcare, and telecommunications suggests an opportunistic operational style focused on high-visibility organizations.

Mechanics of Credential Compromise in Higher Ed

Higher education networks present unique identity architecture challenges. Universities manage tens of thousands of volatile user accounts—including undergraduate students, faculty, research staff, medical workers, and alumni—frequently accessing resources from unmanaged personal devices across diverse network segments.

Credential compromise in these environments typically occurs through several distinct vectors:

• Targeted Adversary-in-the-Middle (AiTM) Phishing: Attackers deploy reverse-proxy phishing kits (such as Evilginx) to bypass traditional SMS or push-based multi-factor authentication (MFA), capturing active session tokens alongside plain-text credentials.
• Credential Stuffing and Password Spraying: Threat actors leverage automated tooling to test leaked credential pairs harvested from third-party breaches against single sign-on (SSO) endpoints, targeting users who reuse passwords.
• Infostealer Malware: Malware infections on student or faculty personal devices harvest stored browser credentials and session cookies, which are then sold on access broker marketplaces.

When an attacker secures a valid account, such as an MSU NetID, they gain a initial foothold. From this position, they attempt to enumerate internal directory services, access cloud-hosted email and storage repositories, or exploit local privilege escalation vulnerabilities on accessible endpoints.

If defenders successfully isolate Active Directory domain controllers, an attacker’s reach is restricted to data accessible directly by the compromised individual accounts or secondary systems relying on weak authorization controls. This structural segregation explains how an attacker might gain limited initial access without securing domain-wide administrator privileges.

Strategic Impact and Blast Radius

The blast radius of a credential compromise in an enterprise higher education environment depends heavily on whether the affected credentials hold elevated permissions or access to centralized data repositories.

If the BYOD gang’s claim of 1.3 million records is verified—even partially—the exposed population likely extends far beyond active students to include decades of alumni, prospective applicants, and former employees. Leaked higher education datasets typically contain Personally Identifiable Information (PII) such as full names, Social Security numbers, home addresses, financial aid records, and contact details. This data provides fertile ground for secondary identity theft, targeted spear-phishing, and financial fraud.

Even in scenarios where Active Directory integrity remains intact, compromised user accounts present a lingering threat. Attackers often establish persistence within secondary services—such as registering unauthorized MFA devices, configuring inbox forwarding rules, or generating API access keys—before perimeter defenders reset the primary password.

Recommended Defense and Remediation Measures

Organizations responding to widespread credential events or threat activity associated with the BYOD ransomware group should execute targeted remediation protocols:

• Enforce Strict Password Policies: Require passphrases of 15 characters or more, matching the mitigation steps taken by MSU, to significantly increase the computational complexity required for offline brute-forcing attacks.
• Revoke Active OAuth and SSO Sessions: Forcing a password reset is insufficient on its own if active session tokens remain valid. Organizations must administratively invalidate all active refresh tokens and user sessions across identity providers (such as Microsoft Entra ID or Okta) during a mass reset.
• Implement Phishing-Resistant MFA: Transition critical SSO workflows from push notifications or SMS to FIDO2/WebAuthn hardware keys or certificate-based authentication to prevent token interception via AiTM phishing frameworks.
• Audit Active Directory Infrastructure: Perform comprehensive audits of Active Directory environments to verify that domain controllers have not been compromised. Inspect for anomalous Kerberos ticket requests (Golden/Silver Tickets), unauthorized changes to Sensitive Rights/ACLs, unconstrained delegation configurations, and new rogue Service Principal Names (SPNs).
• Review Secondary Access Logs: Analyze authentication logs for SaaS applications, VPN gateways, and cloud environments for anomalous access patterns occurring immediately prior to and during the forced reset window, paying particular attention to foreign IP addresses and unexpected device platforms.