Vanderbilt Investigates Cyberattack After BYOD Claims Data Theft
Summary
Vanderbilt says it is responding to an incident that may affect university devices, systems, and cloud services. BYOD claims it encrypted databases and stole data, but the university has not confirmed the group's involvement, encryption, or theft.
Key points
- Vanderbilt confirmed an active cybersecurity incident that may affect university devices, systems, and cloud-based services.
- The BYOD ransomware group claimed responsibility and alleged it encrypted university databases and stole student, employee, and research data.
- BleepingComputer received a photograph of an alleged BYOD ransom note and a video showing infected devices playing an audio warning.
- The university has not confirmed BYOD's involvement, encryption, or data theft, and has not disclosed the nature of the attack or whether it is contained.
- Vanderbilt advised students, faculty, and staff to shut down university devices, disconnect from university Wi-Fi, watch for suspicious activity, and contact its IT service desk if they notice signs of compromise.
Article Details
- Victim Organization
- Vanderbilt University
- Incident Type
- Ransomware attack with alleged data theft; the BYOD ransomware group claimed it encrypted university databases.
- Disclosure Date
- 2026-11-09
- Data Types Exposed
- Student and employee records
- Social Security numbers
- Full names
- Email addresses
- Phone numbers
- Work addresses
- Roles
- Birthdays
- Research data
- Affected Records
- BYOD claimed to possess over 1 million Social Security numbers; this figure and the alleged theft have not been confirmed by Vanderbilt.
- Operational Impact
- Vanderbilt confirmed it was responding to an active cybersecurity incident and warned that university devices, systems, and cloud-based services may be affected. It instructed students, faculty, and staff to shut down university devices and disconnect from university Wi-Fi. Encryption and disruption were not confirmed by the university.
- Ransom Or Extortion
- A ransom note attributed to BYOD threatened to release alleged stolen data and cause further disruption if the university did not negotiate. No ransom amount was reported.
- Claim Status
- alleged