Vanderbilt University Responds to Cyberattack Claimed by BYOD

Vanderbilt University says it is responding to an active cybersecurity incident that may affect university devices, systems and cloud services. The university said on X that its IT team is investigating and working to contain the situation.

Vanderbilt advised students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for signs of suspicious activity. It said these may include unexpected security notifications, unusual file or permission changes in cloud storage, missing or modified files, unfamiliar applications and unexpected authentication requests. People who notice such activity were told to shut down their devices and contact the university’s IT service desk.

The BYOD ransomware group claimed responsibility on its data leak site, alleging it had encrypted Vanderbilt’s databases and stolen student, employee and research data. The group claimed the stolen information included over 1 million Social Security numbers. BleepingComputer also received a photograph of an alleged computer screen displaying a BYOD ransom note. The publication confirmed that a link in the note led to a site operated by BYOD.

Vanderbilt has not publicly confirmed the group’s involvement, whether any data was stolen, or whether devices were encrypted. BYOD, which launched in 2026, lists 5 other organizations on its leak site, according to BleepingComputer.