Michigan State University says suspicious activity found in early October looked like a potential credential compromise and forced password resets for every NetID
Michigan State University told The Record that it became aware of suspicious cyber activity in early October 2026 and immediately began investigating. To protect accounts and systems, the university's IT team required everyone with an MSU NetID to reset their password to a new one of at least 15 characters, in an email sent to campus on 1 October, The Record reports.
A spokesperson said that, based on the investigation to date, the activity appeared to be a potential credential compromise, that current evidence does not indicate a successful compromise of the university's central Active Directory environment, and that there is no evidence other MSU data was accessed, changed or stolen.
According to The Record, the BYOD ransomware gang claimed responsibility. University officials said the claims were tied to the October incident, and the university did not respond to follow-up questions about them, The Record reports.
MSU has not confirmed any data theft. (source: The Record)
- Product
- Michigan State University (MSU NetID accounts)
- Versions
- n/a — organisation cyber incident
- Exploited in Australia?
- unknown
- Patch to
- MSU students and staff: make sure your NetID password was reset as the university required, do not reuse it elsewhere, and be wary of emails, texts or calls that mention this incident or ask for passwords.
- Primary: The Record (2 Nov 2026)