Michigan State University spent October forcing every NetID holder to choose a new password of at least 15 characters. Two days ago, the crew that knocked a New Mexico trauma centre offline claimed the East Lansing campus next.
On the evening of November 1, BYOD added MSU to its leak site, asserting it holds personal information on 1.03 million current and former students, staff records, and current and former passwords. MSU links the listing to early October suspicious activity, which IT called a potential credential compromise. A spokesperson said evidence does not indicate a break of the central Active Directory environment.
Why a hospital attack matters on a campus
BYOD surfaced in September and drew notice after the October 26 intrusion at the University of New Mexico Health Sciences Center. Ambulance traffic moved to Albuquerque and Santa Fe facilities for two hours and four health-professions schools cancelled classes. UNM reported that some end-user devices were affected while core servers were not penetrated, and made no concessions. The group later said it would release decryption keys for hospital machines while keeping the data.
The MSU claim is unverified and no proof of volume has been published. Actor counts are routinely inflated during extortion talks. For healthcare leaders the pattern matters: the same group is now hunting credential stores at institutions that run clinics and teaching hospitals.
Treat identity as the perimeter. Enforce phishing-resistant multifactor sign-in, hunt password spraying across VPN and email portals, and audit service accounts that outlive their owners. Rehearse ambulance diversion with the electronic health record assumed unavailable. Check that vendor analytics credentials are not sitting on public sites – the Denver Health Medical Plan exposure reaching 238,083 members began with a vendor key published online and left live for over a year.
