Vanderbilt University is currently managing an active cybersecurity incident that has affected its internal devices, network systems, and cloud-based services. The university officially acknowledged the breach on Monday, prompting an immediate response from its information technology department to contain the threat. As a precautionary measure, the institution has instructed all students, faculty, and staff to power down university-issued hardware and disconnect from campus Wi-Fi networks.
The BYOD ransomware group has publicly claimed responsibility for the attack, asserting on its data leak site that it has successfully encrypted the university’s databases. The threat actors allege that they have exfiltrated a significant volume of sensitive information, including over one million Social Security numbers, full names, email addresses, phone numbers, and various student and employee records. Furthermore, the group claims to have gained full control over the university's domain controller and accessed proprietary research data.
While the university has confirmed the occurrence of a cyberattack, it has not verified the specific claims made by the BYOD group regarding data theft or the encryption of its systems. The institution has advised its community to remain vigilant for indicators of compromise, such as unexpected security notifications, unauthorized changes to file permissions in cloud storage, missing or modified documents, or unfamiliar applications appearing on their devices. Users have been directed to avoid attempting to troubleshoot these issues independently and to report any suspicious activity to the IT service desk immediately.
Evidence of the intrusion has surfaced through various channels, including photographic documentation of a ransom note titled README_BYOD_31.txt found on a device displaying Vanderbilt-associated icons. This note directs victims to a data leak site operated by the BYOD group and provides instructions for communication via the SESSION encrypted messaging platform. Additionally, reports indicate that some infected devices have been programmed to play audio warnings announcing the compromise of the network.
The BYOD ransomware gang is a relatively new actor in the cybercrime landscape, having emerged in 2026. Prior to this incident, the group had listed five other organizations on its leak site, including a recent attack on the University of New Mexico Health Sciences Center that resulted in significant system outages and disruptions to academic and patient care operations.
Vanderbilt University continues to investigate the scope of the incident. The institution has not yet disclosed the specific nature of the attack or provided a timeline for the restoration of affected services. The university remains in the containment phase of its incident response plan, focusing on securing its infrastructure against further unauthorized access.
