A cyberattack put Vanderbilt’s information at risk. The university’s silence has put its community in the dark.
On Nov. 9, Vanderbilt confirmed a cybersecurity breach and instructed community members to shut down university devices and disconnect from campus Wi-Fi. The ransomware group BYOD claimed responsibility for the attack, alleging it had obtained sensitive university data. Vanderbilt has not verified those claims. As the Vanderbilt Hustler reported, the university’s response has largely focused on containing the attack and restoring systems.
The first responsibility of an institution facing a crisis is to help the people affected by it. At Vanderbilt, those people are students, faculty and staff who have been asked to navigate a cybersecurity attack with little understanding of its scope or potential consequences.
Vanderbilt has communicated what its community should do. It has been far less forthcoming about what its community deserves to know.
— Maggie Young
The university’s updates have largely centered on operational instructions: which devices to shut down and what applications are safe to use or should be avoided. Those instructions are necessary. But they do little to address the questions that have emerged alongside the disruption. Has personal information been accessed? What does Vanderbilt know about the extent of the breach? How will the university notify those affected? When can students, faculty and staff expect answers?
Although access to certain university systems has been resolved, the questions facing the people who rely on them have not. Students, faculty and staff deserve to know whether their information is secure, how the disruption will affect their work and education and what the university intends to do next.
VUIT is responsible for containing the attack and restoring services. But explaining the incident and addressing its consequences for the university community requires leadership beyond the IT department. That responsibility ultimately falls to Chancellor Daniel Diermeier, whose absence from the university’s public response raises a larger question about Vanderbilt’s leadership during this crisis.
The need for such communication was apparent even to universities outside Vanderbilt. After news of the attack became public, Jen Stedelin, Washington University in St. Louis’s Interim Vice Chancellor and Chief Information Officer, sent a message to the WashU community acknowledging the incident, outlining precautionary measures and explaining that WashU was monitoring its own systems.
WashU recognized that an attack affecting another university warranted a response to its own community. Diermeier has yet to offer the Vanderbilt community a comparable acknowledgment.
Diermeier does not need to explain the technical details of the ransomware attack or offer conclusions before the investigation is complete. He does, however, owe the Vanderbilt community recognition of the seriousness of the incident and an explanation of how the administration intends to address its consequences.
— Maggie Young
Instead, much of the information circulating among students, faculty and staff has come through word of mouth, forcing community members to rely on the campus grapevine to make sense of an unfolding situation. We should not have to piece together information about an attack this serious through rumors, secondhand accounts and scattered operational updates.
Vanderbilt’s Nov. 10 update acknowledged that efforts to contain the attack had restricted the university’s standard communications. Although this update may explain some of the difficulty in distributing information, it does not excuse the absence of a more substantive response. If the university’s usual channels are unavailable, it must find alternatives. If investigators cannot yet answer certain questions, the administration should explain those limitations and commit to providing updates as soon as information becomes available.
The consequences of the attack may extend far beyond the temporary loss of university services. BYOD, the ransomware group claiming responsibility, has alleged that it obtained extensive university data, including personal information belonging to students and employees. Vanderbilt has not independently verified those claims. But the possibility that such information was accessed makes the university’s lack of substantive communication all the more concerning.
Students, faculty and staff have almost no way to determine if their information has been accessed and what protections they should take. The university should explain how and when it will notify affected individuals whose sensitive information was compromised.
Communication should not end when the immediate disruption, specifically to university resources, subsides. Vanderbilt must provide a substantive account of the attack.
Vanderbilt regularly establishes expectations for its community members. Students are held to academic and conduct policies and faculty and staff are expected to meet professional and institutional obligations.
When Vanderbilt asks individuals to entrust it with their personal information, professional records and academic work, it assumes an obligation to protect it. Diermeier’s role as chancellor extends beyond representing Vanderbilt during moments of institutional achievement. It also requires him to address the university when negative events happen. Community members should not have to wonder whether its concerns have reached the administration, much less whether anyone intends to answer them.
— Maggie Young
The university should be held to its own standards.
Vanderbilt may not yet have all the answers. But it can explain what it knows, acknowledge that certain aspects remain uncertain and establish a clear commitment to keeping students, faculty and staff informed. That is not an unreasonable expectation during an ongoing investigation. It is a basic responsibility of the institution.
Click Here For The Original Source.
——————————————————–
