Overview
- Vanderbilt confirmed it is responding to an active cybersecurity incident and ordered students, faculty, and staff to shut down university devices and disconnect from campus Wi‑Fi as its IT team works to contain the situation.
- The BYOD ransomware group posted a public claim saying it encrypted university databases and exfiltrated student, employee, and research records including more than 1 million Social Security numbers.
- Journalists received a photograph of an alleged campus screen showing a BYOD ransom note and videos purporting to show infected devices playing an audio warning, but the university has not confirmed those materials or any data theft.
- The attack disrupted services on campus, produced pop‑up ransom messages on some university machines, and left some research files inaccessible in an encrypted “.byod” format while classes were told to continue.
- Security experts note BYOD is a new 2026 ransomware actor that has claimed other academic and health‑sector targets and investigators will now seek to verify any data loss, assess who is affected, and restore systems.