Vanderbilt University in Nashville spent Monday, November 9, telling thousands of students and employees to switch off their computers after what it called an active cybersecurity incident.[1] A ransomware gang named BYOD says it locked the university’s databases and stole data on more than a million people, including Social Security numbers.[1] The university has not confirmed that claim, but if you study, work or have ever applied to Vanderbilt, you should know what is going on and what to do about it.Ad Fortect for WindowsGet a free scan and check if your PC is infected.Free scanTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.Ad Fortect Mobile Security for Android and iPhoneBlock scam sites on your phone: its web protection stops known scam and phishing pages from opening.Get the appOpens Google Play or the App Store, where the vendor states the price.
What happened at Vanderbilt on Monday
The university announced on its X account that it was responding to an active incident that could touch university devices, systems and cloud services.[1] Its IT team said it was investigating and working to contain the problem.[1] People were told to shut down university devices, disconnect from campus Wi-Fi and watch for odd behavior.[1][2]
Some staff described a fast sequence on their screens. One employee told the Nashville Banner her computer first showed a system update notice, then a message that old files were being deleted, then a ransomware warning, after which her files turned into files ending in .byod.[2] A faculty member said Box notifications arrived in the morning saying administrators had deleted files, even though the administrators said they had not touched them.[2]
What the attackers say they took
On Monday BYOD listed Vanderbilt on its leak site. The post boasts of “Over 1 Million SSNs.”[1] It adds full names, emails, phone numbers and student and employee records.[1] The ransom note, saved as README_BYOD_31.txt, reads “We have all of your data including your backups, your entire network is compromised.”[1] It points victims to the gang’s leak site and to a messaging app called SESSION for negotiation.[1]
Practical steps for people linked to Vanderbilt. Sources: BleepingComputer, WPLN.[1][3]
What is confirmed and what is not
Be careful with the numbers. Everything about stolen records comes from the criminals or from their ransom material. BleepingComputer reported that Vanderbilt has not said what kind of attack this is, has not confirmed BYOD’s involvement and has not said whether any data was taken.[1] The same outlet saw a photo of a ransom note on a screen with Vanderbilt icons and checked that the link in it leads to BYOD’s site.[1]
Reports also differ on small details. WPLN said officials announced the incident on a Thursday morning and spelled the gang’s name as BYOB, while the Banner and BleepingComputer both put the announcement on Monday and use BYOD.[1][2][3]
What happened at Vanderbilt on November 9 and 10. Sources: BleepingComputer, Nashville Banner, WPLN.[1][2][3]
Who is affected
Students, faculty and staff felt the disruption first. A junior named Aminat Rosenje told WPLN she learned of the problem in class and used a personal hotspot because the campus network was off.[3] The student newspaper, the Vanderbilt Hustler, reported that the notice reached students roughly ninety minutes later than it reached teaching staff.[2]
Vanderbilt Health said its hospital and clinical facilities were not affected.[2] If the claim is true, former students and past employees could be affected too.
What the university says it is doing
By about 9 p.m. on Monday, campus Wi-Fi was back, yet access to most systems and applications was still limited.[2][3] IT staff were working with government agencies and other partners.[2] A spokesperson, Julia Jordan, said classes should continue as normal, and the university planned a regular schedule for Tuesday, November 10.[3]
Who is BYOD
BYOD is a young ransomware group that launched in 2026 and lists five other organizations on its leak site.[1] Last month it claimed an attack on the University of New Mexico Health Sciences Center that caused outages and disrupted patient care.[1]
What to do now
If you are connected to Vanderbilt, follow the university’s guidance first. Report anything strange, such as unexpected password requests, files moving by themselves, unfamiliar messages or pop-ups, and do not click unfamiliar prompts or try to fix things alone.[3] Reach the IT service desk from a different device or by phone.[3]
Change your Vanderbilt password and any password you reused elsewhere, but only through the official university site you reach by typing the address yourself.Turn on multi-factor authentication for your email, bank and cloud storage accounts.Ignore emails or texts that mention the breach and ask for money, a login or a Social Security number. Scammers copy real incidents quickly, and our pages on the personal data leak email scam and the We hacked your system email scam show how these threats look.Consider a free fraud alert or credit freeze with the credit bureaus if you think your Social Security number was in the records.Check your bank and credit card statements over the coming months.
To learn how this type of malware behaves and why backups matter, see our guide to the Akira ransomware, another group that steals data and then locks systems.
What comes next
Watch for three things. First, whether Vanderbilt confirms that data was stolen and how many people are in it. Second, whether BYOD publishes samples to pressure the university. Third, how quickly the restricted systems come back. If personal data was taken, affected people may receive notification letters in the coming weeks.
Click Here For The Original Source.
——————————————————–
