Overview
- Vanderbilt’s IT detected an active cybersecurity incident and on Monday, Nov. 9 ordered students, faculty and staff to shut down university devices and disconnect from campus Wi‑Fi while investigators worked to contain the problem.
- A ransomware group calling itself BYOD posted on a public leak site saying it encrypted databases and exfiltrated student, employee and research data, alleging more than 1 million Social Security numbers, but Vanderbilt has not verified any data theft.
- The university restored campus Wi‑Fi later, yet access to most systems and applications remains restricted as VUIT works with government partners to investigate and remediate the intrusion.
- Vanderbilt Health instructed employees not to use university IT as a precaution and said its clinical systems have not been affected so far, while students and faculty reported using phone hotspots, printed materials and deadline adjustments to keep classes running.
- Photographs and videos shared with reporters show BYOD‑branded ransom notes and audio warnings on campus machines, experts say universities are attractive ransomware targets because they hold large volumes of personal and research data, and investigators will need to confirm what was accessed to assess impacts on research, records and operations.