Vanderbilt University urged students and staff to power down campus devices and disconnect from Wi-Fi on Monday morning following a cyberattack attributed to the ransomware group known as BYOD, according to The Washington Post.
The ransomware syndicate BYOD took credit for the intrusion on a public leak portal, posting a ransom note that claimed the group locked the university’s databases and exfiltrated an extensive volume of institutional data.
If you could not tell already, your databases are locked. We have your entire estate and research data.
The threat group’s name mocks Bring Your Own Device policies that allow users to connect personal hardware to corporate or institutional networks. Cybersecurity researchers noted that BYOD has recently claimed credit for similar incidents targeting Michigan State University and the University of New Mexico Health System.
🚨 BREAKING: Vanderbilt University is under cyberattack and has told everyone on campus to shut down their devices and get off its WiFi. Hours earlier, the ransomware gang BYOD listed the university on its leak site. It claims it took more than 1 million Social Security numbers.… pic.twitter.com/xCDOUgYaHP
The university, which has its main campus in Nashville, has about 14,000 students and more than 7,000 faculty and staff members. According to Allan Liska, the group emerged recently and has been ramping up its activity, with its first victim recorded on September 29. Security firm Halcyon tracked a 40% increase in ransomware activity between July and September, with 111 groups claiming 2,766 attacks across 122 countries.
As malicious software began spreading across digital infrastructure, broad announcements went out instructing the campus community to sever connections. University officials warned users against trying to investigate or troubleshoot the issue independently.
Students using university-issued hardware reported their desktops filling with copies of the attackers’ readme file alongside unexpected pop-up notifications. Some files stored locally or on cloud platforms were renamed into an encrypted “.byod” format, rendering them inaccessible.
Vanderbilt University Information Technology (VUIT) confirmed the breach to the student newspaper, and Blair School of Music Dean Melissa Rose shared a message with students stating that VUIT was working to contain the incident and that everyone was following university protocols while waiting for further instructions.
Students across the campus reported that VUIT staff entered classrooms to alert faculty that school-issued computers were unsafe to use. Criminology professor Laurie Woods told The Hustler that she experienced pop-up tabs and verbal messaging live in her class, noting that her computer displayed about 40 documents titled ‘Read Me’ alongside a verbal message.
Despite the digital disruption, classes proceeded as scheduled. Assistant director of media relations Julia Jordan confirmed that classes were proceeding normally while the IT team actively investigated and worked to contain the situation. Students were advised to contact course instructors for additional guidance or flexibility on deadlines.
Meanwhile, Vanderbilt Health issued statements clarifying that it operates separately from the university. The health system reported that its own IT systems remained unaffected and patient care continued normally across all clinical locations.
