The BYOD ransomware gang added Michigan State University to its leak site, claiming to have stolen personal information on 1.3 million current and former students. The university, one of the largest in the US, confirmed it detected suspicious cyber activity in early October and immediately began investigating, and subsequently reset the passwords of all student and employee accounts.
To be precise: the university has not confirmed that data was stolen, nor the number the gang cites. Ransomware gangs tend to inflate the scale of thefts to increase pressure to pay, and sometimes post claims that turn out to be exaggerated. On the other hand, resetting every password shows the university is taking the incident very seriously.
Why are universities favored targets? Because they hold huge amounts of personal information on students, alumni, staff and families going back decades. Their networks are unusually open: thousands of users, personal devices, research labs and many separately managed services. Research data, sometimes sensitive, can also interest attackers. All of this makes an academic institution relatively easy to get into and hard to clean up.
The lesson applies to Israeli universities and colleges too, which hold similar data. And for students and alumni anywhere: if you get a breach notice from an institution you attended, change passwords, turn on two-step verification, and be especially wary of emails that use your real details, such as a course name or student number, to look convincing.
