Michigan State says no evidence other data was stolen; a gang lists it and claims 1.3 million students

31 days between a password reset email and a leak site listing

Michigan State University emailed every user at 5:00 PM EDT on Thursday 1 October 2026 and told them to reset their NetID password. A ransomware tracker records the leak site listing of the university by a group called BYOD as discovered at 03:50 UTC on 2 November, which is 22:50 EST on Sunday 1 November, and The Record says the group added the university on Sunday evening. That is 31 days, 6 hours and 50 minutes after the email (derived). The university's own status incident for the reset was created at 4:50 PM EDT on 1 October and closed as "Resolved" at 10:48 AM EDT on 30 October, 61 hours before the listing (derived).

What the gap does not establish is that the two events are one. The Record's opening line says university officials tied the gang's claims to "an incident last month" that forced password resets. The statement it then prints talks only about suspicious activity, a credential compromise and no evidence of other data being taken. It never mentions the gang, and The Record says the university did not answer follow up questions about the claims.

The Record reports the listing as a claim of personal information on 1.3 million current and former students. A tracker's copy of the listing text gives 1.03 million. The group's own post was not visited. Neither figure has been tested by anyone in the sources read, and both are second hand. This briefing was read from 21:01 to 21:11 UTC on Monday 2 November 2026, and a live incident can change within the hour.

Zoom

Who says what, in their own words

Every line below is attributed, and every quotation is short. The group's side comes second hand: The Record, and a monitoring site that says it indexes what ransomware operators post publicly without accessing the stolen content. That site also states that the group is emerging and that the claim "should be treated with caution until independently verified".

What each source prints about the incident, read 2 November 2026. The group's own post was not read.

Source	Says	What it is
The Record, 2 Nov	The group added the university to its leak site on Sunday evening, claiming to have stolen personal information on 1.3 million current and former students.	A news report of a claim
Ransomware tracker, page updated 20:50 UTC	Listing text: "Full Personal Identifiable Information for 1.03 million current and ex students", "current and ex passwords", and "a full compromise towards your System".	The group's wording as copied by a monitor, not verified
MSU spokesperson, via The Record, 2 Nov	The university "became aware of suspicious cyber activity" in early October. The activity "appeared to be a potential credential compromise event". Current evidence does not indicate a successful compromise of the central Active Directory environment.	The affected party's statement, no mention of the group
MSU status page, 1 Oct	An email went to all users at 5:00 PM. The university became aware of suspicious cybersecurity activity. "no evidence that other MSU data has been accessed, changed, or stolen".	The university's own notice, closed 30 Oct
The State News, 5 Oct	The spokesperson said MSU "recently became aware" of suspicious activity. The newspaper adds that the event was focused on accessing user login information.	The sentence about login information is the newspaper's, not a quotation

The university's statement on 2 November reads, in the clauses printed, like the one the student newspaper printed on 5 October. Both say there is no evidence that other MSU data was accessed, changed or stolen, and both say its security measures continue to function as designed. The wording differs only by the word "also" and a comma in the list, 28 days apart (derived). The sources do not say whether the 2 November text was re sent or written after the claim, or whether the claim was tested before it was given.

Stated and not stated: the record, line by line

"Not stated" means not found in the sources read, listed at the end. It does not mean the information does not exist.

What the sources read state, and what they do not, about the incident and the claim. Read 2 November 2026.

The question	Stated	Not stated
What data was taken?	The group, per The Record: personal information on students. The tracker's copy adds passwords. The university: no evidence that other MSU data was taken.	Which fields, whose records, and whether login credentials were taken.
How many people?	A claim of 1.3 million (The Record) or 1.03 million (tracker).	Any count from the university, or any test of either figure.
How was access gained?	"A potential credential compromise event".	How the credentials were obtained, which accounts, and whether multifactor sign in applied.
Did the group have access?	The tracker's copy claims "a full compromise". The university says evidence does not show the central Active Directory was compromised.	Whether the group had any access, to what, and when.
Was a ransom demanded?	Nothing in the sources read.	Whether, how much, and any deadline.
Is it the same incident?	The Record says officials tied the claims to last month's incident.	A statement from the university, in the quotes printed, that names the group or the claim.
Were systems encrypted or disrupted?	Nothing. The status page lists Identity and Access Management as Up.	Any encryption, outage or ransom note.
Notification, monitoring, regulators?	Nothing in the sources read.	Whether anyone has been told, any credit monitoring offered, and any regulator informed.

Zoom

The arithmetic, and what 1.3 million is set against

MSU's own news site says 50,941 students enrolled this fall (5 October 2026). A claim of 1.3 million is about 25.5 times that (derived), and 1.03 million is about 20.2 times (derived). That is a reference, not a verdict. The claim covers current and former students, so it spans many years of enrolment, and a figure of that size is not unlikely for a university of this scale. A living alumni count from an MSU page was not read, because the pages that carry one answered with a bot check and were skipped. The claim figure is the group's and has not been tested.

The two printed figures differ by 270,000, and 1.3 million is about 26 per cent higher than 1.03 million (derived). The sources do not show which wording is the group's, and a typing slip at either outlet is possible. Quote the figure with its source until one of them is corrected.

One more derived gap: the tracker lists the group's attack on UNM on 26 October and the MSU listing on 1 November, 6 days apart (derived). The tracker's time is when it discovered the listing, so the post itself may be a little earlier. Its own "estimated attack date" for MSU is 1 November, which matches the listing and says nothing about when anyone first got in.

Four phrases doing the work of a control

"Potential credential compromise event" describes how access may have been gained, not what was taken. A valid login opens whatever that account is allowed to open, and the statement does not say which accounts or what they reached. The reset on 1 October was a response to that, and it does not tell a reader what the logins were used for before it.

"No evidence" is a statement about what an investigation has found so far, at the date it is given. It is not "no data". The word "other" in "no evidence that other MSU data was accessed" implies that something was in scope. That is this site's reading, and the statement does not say what.

"Security measures continue to function as designed" says controls worked as built. A sign in with a valid password is what a password control is designed to allow. Whether the credentials were used by anyone other than their owners is exactly the unanswered question.

"Resolved" is the status page's word for the reset notice. It was set on 30 October. It says nothing about the investigation, and the sources do not say the investigation ended. A leak site listing, for its part, is the group's own claim, and the sources read agree that little is known about this group.

The same group, a week earlier

The Record says BYOD emerged in September and that little is known about it. It reports that the group drew attention for an alleged attack on Trump Mobile last month, with a leak of data from 3,615 customers that drew Congressional scrutiny, and then for the attack on UNM Health. This site covered the UNM case in its own briefing.

In the UNM case, The Record reported on 29 October that the Health Sciences Center said it had restored systems and had not paid a ransom, and that the group had posted apologies, offered decryption keys for free, and offered to destroy stolen personal information if people contacted it and paid $2,500. The Health Sciences Center warned patients, students and employees not to respond to anyone claiming responsibility. None of that is reported for Michigan State: no ransom figure, note or contact was read in the sources, and no source says Michigan State systems were encrypted. The Record adds that Michigan State previously dealt with a ransomware attack in 2020 by another gang, which is a different incident.

What to do, in order

The first item is the university's own instruction. Items two to four are this site's suggestions and are labelled as such. None involves the group, and none needs the claim to be true.

What was read, what was not, and the question left

Read in full: The Record's article of 2 November and its UNM article of 29 October; MSU's status page incident and the status page home; The State News report of 5 October; MSU's enrolment release of 5 October; and a ransomware tracker's page for the listing. Not read, by design: the group's leak site, its contact channels and any stolen data, and the social post The Record links as its source for the listing. Not read, because the sites answered with a bot challenge and the check was not bypassed: the main msu.edu site and the technology news site on msu.edu that a search result listed for the reset notice. The university may have said more there. The Record's report is the source for the claim and for the statement in the form printed, and where it and the tracker differ, both are shown.

The question the statement has to answer is this. If the activity was a credential compromise that a reset addressed on 1 October, what did the university test, between then and Sunday evening, about a claim that includes passwords and 1.3 million records, and when will it say so?

Key facts