BYOD, the ransomware gang, has also taken credit for recent hacks at Michigan State University and the University of New Mexico.
Photo illustration by Justin Morrison/Inside Higher Ed | SeanPavonePhoto and SuperCubePL/iStock/Getty Images
A gang of criminal extortionists is taking credit for a hack that caused major disruptions at Vanderbilt University this week.
On Monday morning, the university told faculty, students and staff in a statement that it was “responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services,” asking them to “shut down university devices, disconnect from university WiFi, and remain extremely vigilant” and “take immediate action” if they noticed “any unusual or suspicious activity on your devices.”
That left many students with looming assignments and exams scrambling for an internet connection, according to The Tennessean, which reported that students crammed into cafés and coffee shops near campus Monday evening. Meanwhile, the hack blocked other students from registering for spring classes—the registration window closes Friday.
However, classes carried on as scheduled and Wi-Fi was restored Monday night. By Tuesday morning, the university said, it had restored additional networks and systems, including email, Zoom, Brightspace, Okta and enrollment services, but “all other Vanderbilt systems and applications remain restricted.”
The university did not respond to Inside Higher Ed’s specific questions about what types of information were compromised, if it’s paid any ransom to hackers and the timeline for full restoration of its system and networks.
But BYOD, a ransomware group, has already claimed credit for the attack.
“If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess,” the group said, according to Ransomware.live, which tracks ransomware attacks. “Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.”
BYOD, which launched in September, has also claimed responsibility for recent data breaches at 18 other organizations, including Twitter, Michigan State University and the University of New Mexico Health Sciences Center. That attack disrupted patient care at its hospital system.
Universities Vulnerable
The criminal extortion gang’s string of alleged attacks comes months after another ransomware group, ShinyHunters, hacked Canvas, the most popular learning management system among higher education institutions in the United States; Canvas paid the group a ransom to restore its operations. Numerous other universities—including Princeton University, the University of Texas at San Antonio and the University of Illinois at Chicago—have also reported disruptive cybersecurity incidents over the past year. And last month, hackers breached a banking platform used by the majority of California community colleges and stole financial aid money from hundreds of students.
According to Inside Higher Ed’s 2026 Survey of Campus Chief Technology/Information Officers, 59 percent are most worried about a critical cybersecurity breach or ransomware event.
“Universities are about the most open environments an attacker can find,” Sterling Wilson, a CTO at the software company IGEL, told Inside Higher Ed. “They have thousands of unmanaged personal devices, decentralized IT and huge stores of identity data on students, staff, applicants and research.”
He added that the academic calendar “also gives attackers leverage, because every day offline in the middle of a semester carries a real cost,” which the situation at Vanderbilt shows. “The group claims to have more than one million Social Security numbers from the attack. Attackers know a campus can’t stop teaching and running operations, and that pressure is what they’re counting on.”
Nonetheless, it’s possible for universities to avoid the kind of “operational crisis” that came after Vanderbilt told its entire campus to shut down their devices and disconnect from the network while it responded to the attack, according to Gary Barlet, public sector CTO at the cybersecurity company Illumio.
“Universities are incredibly interconnected environments, and students, faculty and staff depend on that connectivity every day,” he wrote in an email to Inside Higher Ed. “That’s why operational continuity has to be part of the cybersecurity conversation. Universities can’t assume they’ll prevent every intrusion. They need to make sure that when something is compromised, they can isolate it quickly and keep the rest of the institution running.”
But if a university’s “only option for containing an attacker is to take critical systems offline,” then it’s “effectively accomplishing part of the adversary’s objective for them: disrupting operations.”
——————————————————–
Click Here For The Original Source.
