Vanderbilt University is restricting access to most of its systems and applications after an active cybersecurity incident disrupted campus technology, while the ransomware group BYOD claims it encrypted databases and stole sensitive university data. The Nashville institution said it was investigating and containing the incident with government agencies and other partners, but has not confirmed the group’s identity or the scope of any data theft. Vanderbilt’s incident update said the disruption affects university devices, systems and cloud-based services.
The university initially instructed students, faculty and staff to shut down university devices, disconnect from campus Wi-Fi and remain vigilant for unexpected pop-ups, altered or missing files, unfamiliar applications and unsolicited authentication requests. Vanderbilt also told anyone seeing suspicious activity not to click links or attachments, attempt troubleshooting or enter credentials, and to contact the IT service desk using a separate device or telephone.
Reports from campus users said some computers played an audio message attributed to BYOD stating that the university had been compromised and directing administrators to contact the group. BYOD subsequently claimed on its leak site that it had locked Vanderbilt databases and taken the university’s “entire estate and research data.” The group alleged possession of more than one million Social Security numbers, names, contact information and student and employee records, but those claims remain unverified. BleepingComputer reported the same allegations while noting that Vanderbilt had not confirmed them.
Campus Wi-Fi was restored Monday evening, but Vanderbilt said access to most online systems remained restricted. Classes, student services and staff operations were scheduled to continue normally Tuesday, although the outage affected some university services; athletics ticketing, for example, was unavailable when students attempted to claim tickets for the football game against Alabama. The university said it would provide further updates on system and application availability.
There is no publicly identified CVE, vendor vulnerability advisory or confirmed exploitation-in-the-wild report tied to this incident, and Vanderbilt has not disclosed the initial access vector. That makes the immediate priority containment and evidence preservation rather than attributing the breach from the attackers’ claims. Universities and other organizations facing similar activity should isolate suspected endpoints, preserve logs and ransom notes, disable potentially compromised credentials only through an established incident-response process, and notify law enforcement and affected individuals if an investigation confirms exposure of personal data.
