Vanderbilt University Shuts Down Campus Devices After BYOD Ransomware Group Claims Network Breach

Vanderbilt University told students, faculty, and staff to shut down university devices and disconnect from campus Wi-Fi on November 9, 2026, while its IT team investigated an active cybersecurity incident.

The warning came as the BYOD ransomware group claimed it had locked university databases and stolen sensitive student, employee, and research data. Vanderbilt has not confirmed the group’s involvement or its data theft claims.

The Nashville university said the incident could affect devices, internal systems, and cloud services. In its official incident update, Vanderbilt urged users to watch for unexpected pop-ups, missing files, unfamiliar applications, and unusual requests for passwords or login approvals. Its IT team began investigating and working to contain the incident.

BYOD posted a message on its data leak site claiming possession of more than one million Social Security numbers, along with names, email addresses, phone numbers, and student and employee records.

The attackers also claimed access to university research data and control of its domain controller. These claims remain unverified, and Vanderbilt has not announced a confirmed number of affected people.

The note linked to BYOD’s leak site and provided contact details through the Session messaging platform. It claimed that backups were compromised and threatened to release data and cause further disruption unless the university negotiated.

Vanderbilt University Shuts Down Devices After Breach Claim

Local reporting also described files changing to the “.byod” extension and university research becoming inaccessible. Those accounts suggest file encryption, but they do not establish how widely systems were affected.

Vanderbilt has not publicly identified the attackers’ entry point, confirmed which systems were encrypted, or explained whether stolen accounts or a software flaw enabled access.

By 7:15 p.m. on November 9, Vanderbilt said campus Wi-Fi was available again. However, access to most university systems and applications remained restricted.

Its IT team was working with government agencies and other partners. The university planned to operate normally on November 10, with classes, student services, and staff attendance continuing as scheduled.

Faculty facing grant deadlines were directed to seek support from the university’s research office. Students were told to contact instructors about additional guidance and flexibility on coursework deadlines. The update showed that network access had partly returned, while important university applications remained unavailable.

BYOD previously appeared in reporting about an alleged Trump Mobile data breach. Separately, the Stanford University ransomware breach shows how campus incidents can expose sensitive records. Neither report establishes how Vanderbilt was breached.

Vanderbilt instructed anyone seeing suspicious activity not to click links, open attachments, or attempt repairs. Users should shut down the affected device and contact the IT service desk from another device or by phone.

The university’s public notice leaves key questions unanswered, including the full scope of any encryption, whether personal records were stolen, and when restricted systems will return to service.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Vanderbilt University Shuts Down Campus Devices After BYOD Ransomware Group Claims Network Breach appeared first on Cyber Security News.