Vanderbilt University has brought Wi-Fi, email and other core systems back online after a cyberattack disclosed on Monday, Nov. 9, forced a campuswide device shutdown.[1][6] A ransomware gang called BYOD has claimed the attack and says it stole more than 1 million Social Security numbers. Vanderbilt has not confirmed that claim.[3]
Nov. 9 attack disclosed | 1 million+ SSNs claimed by BYOD (unverified) | 13,800+ students enrolled | Several weeks to full recovery
What we know
Vanderbilt first warned of an “active cybersecurity incident” on Monday in a statement on X.[1] It told students, faculty and staff to shut down university devices, disconnect from campus Wi-Fi and watch for suspicious activity.[1]
Warning signs listed by the university included unexpected pop-ups, unfamiliar applications and files that were moved, renamed or deleted in OneDrive or Box.[2] Users who saw them were told to shut down the device and contact IT from a separate device.[6]
Campus Wi-Fi returned Monday night.[5] By Tuesday morning, Okta, Outlook email, the Brightspace course system, Zoom and enrollment services were available again, and people could resume using Vanderbilt devices.[6] Other systems, including CampusPrint, remained restricted.[2]
The university said its IT staff was working with government agencies and other partners.[4] It said fully restoring normal operations could take several weeks.[3] A Vanderbilt Health spokesperson told the Nashville Banner that its hospital and clinical facilities were not affected.[4]
What BYOD claims
Unverified claim, BYOD (criminal ransomware group): On its data leak site, BYOD said it had locked Vanderbilt’s databases and taken student, employee and research data.[1] The post listed “Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers,” BleepingComputer reported.[1]
BleepingComputer said it received a photo of a Vanderbilt computer screen showing a BYOD ransom note.[1] It confirmed that the note linked to the site BYOD operates.[1] A video posted to YouTube showed an infected computer playing an audio warning that BYOD had compromised the network.[2]
One Vanderbilt employee told the Nashville Banner that a “system update” notice appeared, then a ransomware warning, and every file on the computer turned into a “.byod” file.[4] A faculty member told the Banner that files in Box, including accreditation records, were deleted by administrators who said they had not touched them.[4]
Vanderbilt has not confirmed BYOD’s involvement or whether devices were encrypted.[1] How the attackers got in has not been disclosed.[3] The university did not answer Inside Higher Ed’s questions on what data was taken or whether it paid a ransom.[5]
Impact on students
The shutdown left students with assignments and exams looking for internet access in nearby cafés, The Tennessean reported, as cited by Inside Higher Ed.[5] Some students could not register for spring classes, and the registration window closes Friday, Nov. 13.[5] Classes continued as scheduled.[5]
Student Government President Simran Fitzpatrick and Vice President William Dean told The Vanderbilt Hustler they were frustrated by “the university’s lack of clear communication,” CyberScoop reported.[2] The Hustler also reported that students were notified more than 90 minutes after faculty.[4]
Who is BYOD
BYOD is a ransomware group that appeared in 2026. CyberScoop and Inside Higher Ed date its launch to September.[2][5] Reports of its other victims differ:
- BleepingComputer: 5 other organizations listed on BYOD’s leak site.[1]
- Inside Higher Ed: BYOD has claimed breaches at 18 other organizations.[5]
The group has claimed attacks on Michigan State University and the University of New Mexico Health Sciences Center.[5] The New Mexico attack in October caused outages and disrupted patient care.[2]
What happens next
BYOD has threatened to publish the data it says it holds.[3] Vanderbilt said it was still determining what data, if any, was accessed.[3] The university had warned users against unexpected requests to enter passwords or approve logins.[2]
Fifty-nine percent of campus technology chiefs named a critical breach or ransomware event as their top worry in Inside Higher Ed’s 2026 survey.[5] For other recent attacks, see the Boston Report’s security threat warnings tracker, its report on France blaming Iran for a supermarket freezer hack, its story on an AI hacking tool exposed online, and the Technology section.
Sources
- BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed
- CyberScoop: Vanderbilt University reels following ransomware attack claimed by BYOD group
- Malwarebytes: Vanderbilt restores systems after cyberattack as hackers claim data theft
- Nashville Banner: Cybersecurity breach impacts Vanderbilt University
- Inside Higher Ed: Ransomware Gang Says It Hacked Vanderbilt University
- ABC News: Vanderbilt reacts to ‘cybersecurity hacking incident’: What to know
Read next in Crime & Law
Most read this week
- U.S. Envoys Witkoff and Kushner Hold Talks With Putin in Moscow, Then Head to Dublin to Brief Zelensky
- Israeli Strike on Gaza’s Nasser Hospital Kills Six, Including a Surgeon, Health Ministry Says
- Kremlin Names Abu Dhabi Team as Ukraine Sets Security and Prisoner Priorities
- Drones Kill Workers at Zaporizhzhia Nuclear and Thermal Plants, IAEA Says, as Russian Strikes Hit 5 Substations
- Fall Out Boy Will Play Fenway Park on July 30, 2027, With The Offspring, Good Charlotte and The Story So Far
Latest
- Rubio and Hegseth Live Two Doors Apart at Fort McNair
- Red Sox Inquire About Seiya Suzuki After Ranking 26th in Homers
- Trump Pulls Vance Off Iran Talks, Says No Deal Needed
- Nvidia CEO Huang resigns as shares plunge 13% at the open
- South End’s Carter School Wins $100,000 School on the Move Prize
Get The Boston Report Briefing
Our free weekly email with the most important stories from Boston and the world. Unsubscribe anytime.
Free. We never sell your address. Privacy policy