Vanderbilt University Recovering From Ransomware Attack - GovTech
Vanderbilt University is responding to an active cybersecurity incident, asking students, faculty and staff to shut down devices and disconnect from campus Wi-Fi.
The university's IT team is working to contain the situation, which could affect university-issued hardware, internal systems and cloud-hosted services. Vanderbilt is collaborating with government agencies and other partners on its response.
In a Monday evening update, Vanderbilt reported that campus Wi-Fi was available, but access to most systems and applications remained restricted. The university confirmed it would operate on a normal schedule Tuesday, with classes, student services and staff work proceeding as planned.
Ransomware group claims responsibility
The ransomware group BYOD has claimed responsibility in a post on its leak portal, stating it locked the university's databases and stole data including more than 1 million Social Security numbers, names, email addresses and phone numbers. A ransom note visible in an image of what appears to be a computer display points to a website run by BYOD.
Whether the group was involved, and whether any data was compromised, remains unconfirmed by the university
Student reports and health system response
Students on university-issued devices described screens quickly becoming cluttered with duplicates of the hackers' ransom readme and pop-up windows, according to Gizmodo. Vanderbilt Health, which operates separately from the university, instructed its employees to stay off university IT systems until further notice, though its own systems remain unaffected and it continues treating patients.
BYOD launched in 2026 and had previously claimed responsibility for an attack on Michigan State University, according to Axios. Faculty with grant submissions due this week were told to contact Vice Provost for Research and Innovation Susan Marguiles for support.
Related
