Skip to content

Vanderbilt Tells Staff and Students to Shut Down Devices After Attack

By Outages Now Editors

Night view of the iconic mural-covered UNAM library in Mexico City.
Photo: Israel Torres / Pexels

Vanderbilt University confirmed on Monday that it is dealing with an active cybersecurity incident that may affect university devices, systems and cloud-based services. The school told students, faculty and staff to shut down university devices and disconnect from university Wi-Fi, according to BleepingComputer.

The university has not said which services are down or when they will return. A ransomware group calling itself BYOD says it carried out the attack.

What Vanderbilt has said

In a statement on X, the university said its information technology team is investigating and working to contain the situation. Vanderbilt has not publicly described the nature of the attack and has not confirmed whether any data was stolen.

People on campus were also told to watch for signs that a device or account has been compromised. The university listed these:

  • unexpected pop-ups or security notifications
  • unusual changes to files or permissions in cloud storage
  • missing or modified files
  • unfamiliar applications
  • unexpected authentication requests

Anyone who sees such activity should not try to investigate or fix it. The instruction is to shut the device down at once and contact the university’s IT service desk.

What the ransomware group claims

On Monday, BYOD listed the university on its data leak site. The group says it encrypted Vanderbilt’s databases and stole sensitive information about students and employees, and its post claims more than 1 million Social Security numbers, along with names, email addresses, phone numbers and student and employee records. These are the group’s claims, and Vanderbilt has not verified them.

BleepingComputer said it received a photograph of an alleged computer screen showing a BYOD ransom note named “README_BYOD_31.txt”. The note links to the group’s leak site and gives contact details on the SESSION encrypted messaging platform for negotiations. BleepingComputer confirmed that the link in the note leads to the site BYOD operates. The note also threatens to publish stolen data and cause further disruption if the university does not negotiate. A video shared on YouTube and sent to the outlet shows infected devices playing audio that says the network has been compromised by BYOD.

Even so, Vanderbilt has not confirmed the group’s involvement or whether any devices were encrypted.

What is known about BYOD

BYOD is a ransomware group that began operating in 2026. Its leak site currently lists 5 other organizations. Last month the group claimed an attack on the University of New Mexico Health Sciences Center, which caused system outages and disrupted patient care and academic activities.

What it means for Vanderbilt users

For now, the university’s guidance is the one official instruction: shut down university devices, stay off university Wi-Fi and report anything unusual to the IT service desk. Vanderbilt has not said whether email, learning platforms or other services are working, and it has not given a time for restoration.

Source: BleepingComputer

More outage news