Vanderbilt University responds to cyberattack claimed by BYOD ransomware gang - MLQ.ai
Vanderbilt University has confirmed an active cybersecurity incident and advised staff to shut down university devices and disconnect from university Wi-Fi.
The university announced on Monday that it is responding to an active cybersecurity incident that could impact university devices, systems, and cloud-based services. Staff were instructed to shut down university devices, disconnect from university Wi-Fi, and remain extremely vigilant.
The same day, a ransomware group calling itself BYOD claimed responsibility for the attack on its data leak site. The group says it has locked Vanderbilt's databases and taken the university's estate and research data, including more than 1 million Social Security numbers, names, email addresses, phone numbers, and student and employee records.
A Vanderbilt Health spokesperson confirmed that the hospital and clinical facilities were not affected by the incident.
Claims and verification
The group's ransom note claims control of the domain controller and the backups and threatens to release the data if the university does not negotiate. BleepingComputer saw a photo of an allegedly infected Vanderbilt computer showing a ransom note named README_BYOD_31.txt that links to BYOD's leak site, and a video of devices playing audio saying the network had been compromised by 'BYOD'.
Employees told the Nashville Banner that files on the university's Box cloud storage were deleted on Monday morning and that one computer's files were renamed with a .byod extension after a ransomware warning appeared. Vanderbilt has not confirmed BYOD's involvement or any of these claims.
New group targeting universities
BYOD appeared this year and its leak site lists five other organizations. Last month it claimed an attack on the University of New Mexico Health Sciences Center that caused outages and disrupted patient care, and it has also claimed Michigan State University, according to the Nashville Banner.
Vanderbilt told users to watch for unexpected pop-ups, changed files or cloud permissions, and unfamiliar authentication requests, and to shut down rather than troubleshoot a suspicious device.
Related
