The Vanderbilt cyberattack prompted the university to tell students, faculty and staff to shut down university devices on November 9. The BYOD ransomware group claimed responsibility, alleging that it encrypted databases and stole sensitive information, although Vanderbilt has not confirmed those claims.
The university said its IT team was investigating an active cybersecurity incident and working to contain it. It also warned that the disruption could affect university devices, systems and cloud-based services.
University tells users to disconnect devices
As part of its response, Vanderbilt instructed users to disconnect from university Wi-Fi and remain alert to suspicious activity. Its guidance identified unexpected pop-ups, security notifications and unfamiliar applications as possible signs of compromise.
Other warning signs included missing or modified files, unusual changes to cloud storage permissions and unexpected authentication requests. However, these indicators do not establish which systems the attackers accessed or how far the incident spread.
Anyone noticing suspicious activity should shut down their device and contact the university’s IT service desk, Vanderbilt said. Furthermore, the university instructed users to avoid investigating or troubleshooting suspected compromises themselves.
BYOD claims extensive data theft
BYOD listed Vanderbilt on its data leak site on Monday, claiming it had encrypted university databases and gained extensive network access. The gang also alleged that it stole research information and records belonging to students and employees.
According to the attackers, the stolen material includes more than one million Social Security numbers, alongside names, email addresses and phone numbers. Nevertheless, these figures remain unverified, and Vanderbilt has not publicly confirmed any data theft.
A photograph shared with journalists reportedly shows a computer screen displaying Vanderbilt-related icons and a ransom note named “README_BYOD_31.txt”. The note directs the university to the gang’s leak site and provides contact information for negotiations through an encrypted messaging platform.
It also claims that the attackers accessed backups and threatens to publish stolen information if the university refuses to negotiate. However, the appearance of a ransom note does not independently verify the gang’s claims about the volume or sensitivity of stolen data.
Vanderbilt cyberattack investigation leaves questions open
A separately shared video reportedly shows affected devices playing an audio message announcing a compromise by BYOD. Together, the footage and ransom note point toward the group’s involvement, but Vanderbilt has not officially identified the attackers.
The university also has not confirmed whether ransomware encrypted its systems or whether responders have contained the incident. Consequently, the confirmed scope remains narrower than the claims published by the gang.
BYOD emerged in 2026 and lists five other organizations on its leak site. Last month, it claimed responsibility for an attack on the University of New Mexico Health Sciences Center that disrupted systems, patient care and academic activities.
For now, the Vanderbilt cyberattack remains under investigation. The university’s immediate guidance focuses on disconnecting devices and reporting suspicious activity through its IT service desk.
0 responses to “Vanderbilt cyberattack prompts shutdown warning”