Michigan State University Data Breach

The BYOD ransomware group listed Michigan State University (MSU) on its dark web leak portal on November 2, 2026, with the listing identified through SOCRadar’s Dark Web Monitoring service. MSU is one of the largest public research universities in the United States, an institution whose credential surface spans hundreds of thousands of current students, faculty, staff, and alumni across dozens of departments and affiliated research domains. That scale and diversity of identities gives a major public university an extensive credential surface, and accounts tied to academic and research activity of this kind can make an institution an attractive target for ransomware and extortion operations. BYOD has claimed 12 victims in the past 60 days, with Education as its most frequently targeted sector. The group’s footprint is predominantly US-centric: recent listings in the same window include the University of New Mexico and two mobile-carrier victims, TMobile and Trump Mobile Wireless, while Canada and Singapore complete the geographic spread. Michigan State University’s listing is consistent with the group’s established targeting pattern, aligning both with its emphasis on the Education sector and with its concentration on United States-based victims.

SOCRadar’s stealer-log query for msu[.]edu returned no records in this period. For an institution of this size, that result should be read with caution rather than as reassurance. Stealer-log coverage depends on which domain formats are included in the automated pipeline, and credentials belonging to the university community may sit under affiliated research subdomains, regional portals, or personal email aliases outside the standard @msu.edu format, none of which may be captured in the current dataset. The absence of records therefore does not confirm that Michigan State University is unaffected: exposed credentials could exist in feeds outside the queried dataset, or under address formats the pipeline does not index. A lack of direct stealer-log correlation does not rule out a possible connection between credential exposure and the claimed intrusion, and the BYOD listing itself remains an alleged claim whose technical basis has not been independently verified. Because the university’s identity environment extends across students, faculty, staff, and alumni in dozens of departments and affiliated research domains, account structures may vary widely and may not match the standard domain format used in automated queries. Based on the information currently available, the appropriate measures are continued dark web and stealer-log monitoring, proactive credential-hygiene checks, and expanded monitoring for credentials appearing under affiliated research subdomains, regional portals, and personal email aliases.