Vanderbilt University said it is responding to a cyberattack that the BYOD ransomware gang claimed, saying it encrypted the university’s databases and stole sensitive student, employee and research data.
The university confirmed Monday that it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services, and said in a statement on X that its information technology team is investigating and working to contain the situation. It told students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for suspicious activity. Signs of compromise may include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage, missing or modified files, unfamiliar applications and unexpected authentication requests. Anyone who notices such activity was told not to investigate or troubleshoot it, but to shut down the device immediately and contact the university’s IT service desk.
Vanderbilt has not disclosed the nature of the attack, confirmed that any data was stolen, said whether systems were encrypted or confirmed the group’s involvement.
On Monday, BYOD claimed responsibility on its data leak site. The group said it had locked the university’s databases and holds its entire estate and research data, including over 1 million Social Security numbers, full names, email addresses, phone numbers and student and employee records, along with a full takeover of the university’s domain controller.
A photograph of an alleged computer screen shows Vanderbilt University icons and a BYOD ransom note named README_BYOD_31.txt. The note includes a link to the BYOD leak site, which has been confirmed as the one the group operates, and contact information on the SESSION encrypted messaging platform for negotiating with the gang. It claims the group has all of the university’s data, including backups, and that every Social Security number is archived along with full names, email addresses, phone numbers, work addresses, roles and birthdays. It threatens to release the stolen data and cause further disruption if the university does not negotiate. A video shared online also shows infected devices playing an audio warning that the network has been compromised by BYOD. These claims have not been verified, and Vanderbilt has not confirmed them.
BYOD is a relatively new ransomware gang that launched in 2026 and lists five other organizations on its leak site. Last month, it claimed an attack on the University of New Mexico Health Sciences Center that caused system outages and disrupted patient care and academic activities.
——————————————————–
Click Here For The Original Source.
