Vanderbilt University confirmed on Monday, 9 November, that it was responding to "an active cybersecurity incident that may impact university devices, systems, and cloud-based services." It told students, faculty and staff to shut down university devices and get off campus Wi-Fi. The same day, the BYOD ransomware gang added a "Vanderbilt EDU" listing to its leak site. The gang claims it encrypted the university's databases, took over its domain controller and stole research data, student and employee records, and more than 1 million Social Security numbers. Vanderbilt has not named a group, used the word ransomware, or confirmed that any data was taken. The student newspaper, The Vanderbilt Hustler, reported that the university's IT department (VUIT) confirmed a breach to the paper but would not confirm what the gang says it stole. Vanderbilt is a private research university in Nashville. DysruptionHub puts its fall enrollment at 13,813, and Recorded Future News puts it at about 14,000 students and more than 6,000 staff.
What Happened
The first sign of trouble came on Monday morning. A faculty member told the Nashville Banner that staff began getting alerts that files in the Box cloud storage platform had been deleted by administrators, and those administrators said they had not touched the files. The first files to go included accreditation material and admissions procedures.
The university posted its first notice on X and its news site at about 10:45 a.m. local time. It asked everyone to shut down university devices, disconnect from university Wi-Fi and "remain extremely vigilant." It listed warning signs to look for:
- unexpected pop-ups or security warnings
- unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage
- files that had been moved, deleted, renamed or changed
- unfamiliar applications or prompts
- unexpected requests for passwords, logins or approval of sign-ins
Anyone who saw these signs was told not to troubleshoot, to shut the device down at once and to call the IT service desk from a different device or phone. DysruptionHub points out that these were warning signs for people to report, not a confirmed finding of encryption or stolen credentials.
People on campus described what looks like ransomware being deployed:
- One employee told the Banner that their computer showed a "system update" notification, then a message saying it was deleting old files, then a ransomware warning with a link. After that, every file on the machine had a ".byod" extension.
- Gizmodo, citing the Hustler, reports that students with university-issued devices saw their desktops fill with copies of the attackers' ransom note. Nashville Scene reported a similar case of files rewritten in ".byod" format, and a researcher whose work on university systems could no longer be opened.
- The Hustler reported that VUIT staff went into classrooms to tell faculty to shut down computers. Users were also told to close Microsoft Word and their OneDrive and Dropbox folders.
- A source who was not authorised to speak on the record told the Banner that the employee IT help line "had crashed." Several employees said they had received no guidance at all.
The accounts of disruption to teaching do not match. A university media relations official told Axios that classes were going ahead as normal, and the university posted at 1 p.m. that classes were "proceeding as scheduled." The Hustler, as cited by Gizmodo, reported that some professors cancelled classes anyway.
In a 7:15 p.m. update, Vanderbilt said campus Wi-Fi was back but access to most systems and applications was still restricted. It said Vanderbilt IT is "working with government agencies and other partners." The university said it would run on a normal schedule on Tuesday, 10 November. Faculty with grant deadlines that week were pointed to the Vice Provost for Research and Innovation's office for help. The next update was promised by 9 a.m. Tuesday.
Vanderbilt Health is legally and financially separate from the university. It told employees not to use university IT systems until further notice. It told WSMV and the Banner that its own systems were not affected and that patient care was continuing at all hospital and clinic locations.
What Was Taken
The only description of the stolen data comes from the attackers. BYOD's leak-site post reads:
"If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess."
The post ends by telling the university to make contact through the gang's site and threatens to "take you down" once talks begin.
The figure of more than 1 million Social Security numbers comes only from BYOD. No one has verified it. It is far larger than Vanderbilt's current headcount of roughly 20,000 students and staff. If the claim is true, the data could include past students, former employees, applicants, or people who took part in research studies. As of Monday evening:
- BYOD had not published any sample files, according to DataBreach.com.
- Vanderbilt had not confirmed that any personal data was accessed or stolen.
- No regulator filing or breach notification had been published.
The research data claim stands out. Researchers have reported losing access to their work, which shows that research systems were affected. Whether any research data was actually copied out remains unconfirmed.
Why It Matters
BYOD is new and moving fast. Ransomware researcher Allan Liska, cited by CyberSIXT, says the group posted its first victim on 29 September 2026. Since then it has claimed attacks on Michigan State University and the University of New Mexico Health System. Vanderbilt is at least its third claimed victim in higher education or academic medicine in about six weeks. That pattern suggests the group is deliberately going after universities.
Universities are an easy target in several ways. They keep large amounts of identity data over many years. Their networks are spread out and run by many separate departments. Researchers and staff rely heavily on synced cloud storage. Two parts of this incident should worry defenders most:
- The claimed domain controller takeover. If true, the attackers had the logins and permissions that control almost every Windows account and machine on the network. That would explain how encryption reached ordinary users' devices.
- Damage to cloud storage. Box files were deleted by what appeared to be administrator accounts, and the university warned about changes in OneDrive. Together these suggest the attackers reached cloud storage through synced endpoints or stolen administrator accounts. Cloud copies of files may not be a safe backup.
The university's decision to tell everyone to power devices off was blunt and costly, but it was a sensible way to stop encrypted files from syncing into shared cloud storage.
The Attack Technique
How the attackers got in has not been disclosed. Vanderbilt has not described the type of attack, how the attackers entered, or how far they got. Based on public reporting, here is what is known so far:
- Encryption: Files were renamed with a ".byod" extension, and ransom notes appeared on desktops. Several people described this independently to the Banner, Nashville Scene and the Hustler.
- Disguised payload: One employee saw a fake "system update" message, then a "deleting old files" message, before the ransom warning appeared. Wiping or deleting files before or during encryption would be consistent with attackers removing local copies so they cannot be recovered.
- Compromised accounts: Box files were deleted by administrator accounts whose owners said they had not acted. This points to stolen or hijacked administrator accounts on the cloud platform. It has not been confirmed.
- Domain control: BYOD says it fully took over the domain controller. If so, the attackers could push malicious software across the whole network through Active Directory, for example with Group Policy or remote execution tools. Vanderbilt has not confirmed this.
- Data theft: Claimed but not shown. No sample files have been released.
Nothing published so far identifies the initial way in, such as phishing, a vulnerable VPN or other internet-facing device, or a stolen password. Defenders should not assume any of these until Vanderbilt or its responders say more.
What Organizations Should Do
- Treat domain controllers as your most important systems. Use dedicated administrator workstations and separate tiers of admin accounts. Monitor closely for new Group Policy objects, scheduled tasks pushed across the domain, and changes to privileged groups. Practise a full Active Directory recovery from offline backups.
- Protect administrator accounts on cloud storage. Require phishing-resistant MFA, such as hardware security keys, for Box, OneDrive and SharePoint administrators. Alert on bulk deletions or permission changes. Make sure version history and recycle-bin retention are long enough that an attacker with admin rights cannot remove them.
- Plan for encrypted files syncing to the cloud. Know how to pause sync client-wide, or cut off a compromised user's sync session, at short notice. Test restoring large shared folders from snapshots that cannot be altered or deleted.
- Look out for fake update screens. Teach help desk staff and users that an unexpected "system update" followed by file deletion messages is a sign of an active attack. Endpoint detection should flag mass renaming, shadow copy deletion and bulk file deletion as high-priority alerts.
- Set up communication channels that work when the network is down. The help line collapsing and employees getting no guidance are common failures. Keep a phone tree, text alerts and an outside status page that do not depend on the network being attacked.
- Hunt for signs of BYOD now if you work in higher education or academic medicine. Search for ".byod" file extensions and ransom notes. Look for unusual administrator logins to cloud storage, and large outbound data transfers since late September, when the group first appeared. Share any findings with your sector's information-sharing centre, such as REN-ISAC for universities.
Sources: Vanderbilt University hit in BYOD ransomware attack, data theft cla... | Nov. 9: Active Cybersecurity Incident Updates News Vanderbilt Uni... | Vanderbilt urges campus to shut down computers amid cyberattack | Vanderbilt Orders Campus Offline as Ransomware Gang Says It Took Ov... | Vanderbilt cyber incident prompts Tennessee device shutdowns | Attackers Claim to Have Stolen Data on Over 1 Million Vanderbilt St... | Vanderbilt tells everyone to shut down devices in active cyberattack | Cybersecurity breach impacts Vanderbilt University - Nashville Banner