Vanderbilt University officials ordered students and staff to shut down devices and disconnect from campus Wi-Fi on Monday following a suspected ransomware attack.
A ransomware group calling itself BYOD claimed responsibility for the breach, alleging it stole sensitive data belonging to more than one million people associated with the institution, according to Hindustan Times.
BYOD claims theft of million records
BYOD claims theft of million records
The cybercrime group posted a message on the Ransomware.live website claiming it had encrypted Vanderbilt’s databases and seized control of the university’s domain controller infrastructure. The group alleged the stolen information included Social Security numbers, names, email addresses, phone numbers, and both student and employee records, Gizmodo reported.
In its online post, the group threatened the university, stating, We have your entire estate and research data,
BigGo Finance reported.
The group’s name is a reference to Bring Your Own Device
policies that allow users to access corporate networks via personal hardware. The breach was reportedly discovered at 9:50 a.m. CST, though the Vanderbilt community did not receive official communication until 11:26 a.m. CST.
Vanderbilt University has not verified the group’s claims or the specific scope of any data exfiltration. However, The420 noted that if the claim regarding one million Social Security numbers is accurate, the incident would represent extensive identity exposure for the campus community.
University response and device instructions
VUIT issues device instructions
Vanderbilt University Information Technology (VUIT) is investigating the incident. The university issued urgent instructions to the community to SHUT DOWN YOUR DEVICE IMMEDIATELY to help prevent potential further security risks,
Gizmodo reported.
VUIT also advised users to stay off campus networks, avoid attempting to troubleshoot the issue themselves, and close all instances of Microsoft Word, OneDrive, and Dropbox folders, Hindustan Times reported. In a separate notification, administrators warned users not to attempt to investigate or resolve the issue independently to minimize security risks.
Blair School of Music Dean Melissa Rose told students in a message that everyone was following university protocols while waiting for further instruction, Hindustan Times reported. VUIT staff entered classrooms across campus to alert faculty that school-issued computers were unsafe to use.
For faculty with upcoming grant submissions, Vanderbilt directed them to contact Vice Provost for Research and Innovation Susan Marguiles, whose team can assist with timely submissions.
Students using university-issued devices reported seeing ransomware messages and pop-up notifications on their desktops.
Reports from employees indicated that files on Box cloud storage were deleted on Monday morning. Other users observed files being renamed with a “.byod” extension, and one individual reported receiving a system update notification followed by a message deleting old files.
Impact on campus operations and student life
Disruption to classes and students
While Vanderbilt University stated that classes were proceeding as scheduled, some instructors canceled sessions due to the breach, The Vanderbilt Hustler reported.
The disruption forced many students to seek Wi-Fi at local coffee shops and cafes near 21st Avenue South to complete assignments. The Tennessean reported.
One student, freshman Cayleigh Maxwell, reported being unable to access Microsoft Word documents on the university’s OneDrive. At approximately 5:30 p.m., she and her friends were working at a Panera location to find connectivity.
Criminology professor Laurie Woods reported experiencing pop-up tabs and verbal messaging live during her class. It is out of our control, so all we can do is make the best of it. On the other hand, it reminds us of the power of [the] internet and AI,
Woods told The Hustler.
A university spokesperson, Julia Jordan, stated at 3:30 p.m. that classes were proceeding as planned and that no further updates were available at that time.
Vanderbilt Health remains separate
Vanderbilt Health systems not impacted
Vanderbilt Health, which is a legally and financially separate organization from the university, stated its own IT systems have not been impacted by the incident, WSMV reported.
In a statement, health system spokesperson Craig Boerner said, We are continuing to monitor the situation closely,
adding that the organization is taking precautions to ensure its computer systems are secure.
The health system emphasized, The safety of our patients is our top priority and patient care is continuing at all our hospital and clinical locations. We are proceeding with the utmost care and diligence,
WSMV reported.
Patterns in BYOD targeting
The BYOD group has previously claimed responsibility for cyberattacks against Michigan State University and the University of New Mexico Health System, BigGo Finance reported. The University of New Mexico incident was noted for causing ambulance diversions and canceling clinic appointments.
Ransomware expert Allan Liska told The Record that the group has been ramping up activity recently, noting that the group’s first known victim was not seen until September 29. The group has also been linked to an attack on Trump Mobile, which reportedly led to the leak of data from 3,615 customers.
This incident occurs during a period of increased ransomware activity. Halcyon reported a 40% increase in ransomware activity between July and September, with 111 groups claiming 2,766 attacks across 122 countries. Trellix researchers noted that new groups accounted for a third of all posts in August, describing the fragmentation of the threat landscape as structural.
Vanderbilt University Medical Center was previously the target of a ransomware attack in 2023, according to The Record.