Vanderbilt Responds to Ransomware Attack Claimed by BYOD

Summary

Vanderbilt University is responding to a ransomware incident claimed by BYOD; the group says it obtained more than 1 million Social Security numbers. Some university services were restored, while others remained restricted.

Key points

Vanderbilt discovered the ransomware incident Monday and initially told community members to shut down university devices and disconnect from campus Wi-Fi.
The university said the response disrupted normal communications and involved government agencies and other partners.
BYOD claimed responsibility in a post on its leak blog; that claim does not independently confirm the incident’s full impact.
BYOD claims it obtained more than one million Social Security numbers from the attack.
Some services, including campus Wi-Fi, Okta, Outlook and Zoom, were reported safe to use Tuesday; CampusPrint remained restricted.
Vanderbilt urged users to watch for suspicious account or device activity and unexpected credential or authentication requests.

Article Details

Victim Organization: Vanderbilt University
Incident Type: Ransomware attack
Data Types Exposed: Social Security numbers (claimed)
Affected Records: BYOD claims to have more than one million Social Security numbers.
Operational Impact: The university took several digital services intermittently offline. Some systems and applications were later cleared for use, while others remained restricted. University devices were temporarily shut down, and the university said response efforts disrupted normal communications.
Ransom Or Extortion: Students raised concerns about extortion threats. BYOD claimed responsibility for the attack; the article reports no ransom demand.
Claim Status: claimed

People

Simran FitzpatrickVanderbilt University Student Government President who discussed student concerns about the attack, extortion threats, and the university's communications.William DeanVanderbilt University Student Government Vice President who discussed student concerns about the attack, extortion threats, and the university's communications.

Threat Actors

BYODThe ransomware group claimed responsibility for the attack in a post on its leak blog and claimed to have more than one million Social Security numbers from Vanderbilt.

Products

Boxpop-ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms; unexpected file movement, deletion, renaming or modification; unfamiliar Brightspacecampus-wide systems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.CampusPrintcampus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.Microsoft OneDrivepop-ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms; unexpected file movement, deletion, renaming or modification;Oktaan update that select campus-wide systems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.Outlookthat select campus-wide systems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.YESand applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.Zoomsystems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint.