Overview
- Vanderbilt disclosed an active cybersecurity incident on Monday and ordered students and staff to shut down university devices and disconnect from campus Wi‑Fi to contain the threat.
- Campus Wi‑Fi was restored in the evening update but access to most university systems and applications remains restricted and the university told classes to proceed on a normal schedule the next day.
- A ransomware group calling itself BYOD posted claims on a leak site saying it accessed vast volumes of data, including Social Security numbers, but Vanderbilt has not verified those claims and outside experts say forensic work is needed to prove what was copied.
- Vanderbilt Information Technology is coordinating with government agencies and external partners on containment and investigation, and Vanderbilt Health said its clinical systems have not been affected while advising staff not to use university IT resources.
- Students and faculty reported disruption to teaching and coursework that included using phone hotspots and printed materials and extended deadlines, and investigators say confirmed scope will shape required notifications and remediation steps.