Michigan State University msu.edu Michigan State University data breach: what happened and what to do
In November 2016, Michigan State University said an unauthorized party reached a server holding about 400,000 student and employee records. It said 449 records were confirmed accessed: names, Social Security numbers and MSU ID numbers.
View all 13,177 breaches- Breach date
- 13 Nov 2016
- Data exposed
- Names, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Michigan State University (MSU) announced on November 18, 2016 that an unauthorized party had reached a university server on November 13, 2016. The database held about 400,000 records of current and former students and employees. That figure is the size of the database, not the number of people confirmed affected.
MSU said 449 records were confirmed as accessed and took the database offline within a day. A university spokesperson said the hackers demanded money and the university did not pay.
Sources checked: msutoday.msu.edu, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The database held names, Social Security numbers and MSU ID numbers, with dates of birth in some cases. MSU said passwords and financial, academic, contact and health information were not in it.
The university's response
MSU worked with federal law enforcement and the MSU Police Department, and offered two years of identity theft protection, fraud recovery and credit monitoring at no cost. It pointed people to a university data security page for more information.
What it means for you
A name and Social Security number are the core of identity theft, and an SSN can't be changed. If you were a student or employee around then, a credit freeze is the standard protection. The FTC says freezes are free and don't affect your credit score.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- California Attorney General , filed 18 Nov 2016
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the MSU breach?
MSU said the database held about 400,000 records, and 449 were confirmed accessed. Notices went to people in the database, so check for a letter or email.
What was exposed?
Names, Social Security numbers and MSU ID numbers, with dates of birth in some cases, according to the university.
Should I freeze my credit?
If your Social Security number was in the database, the FTC recommends considering a free credit freeze at all three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
