Vanderbilt University tells campus to shut down devices as BYOD ransomware gang claims attack

Vanderbilt University in Nashville is dealing with what it calls an “active cybersecurity incident” affecting university devices, systems and cloud-based services. On Monday, November 9, 2026, it told students, faculty and staff to shut down university devices and disconnect from campus Wi-Fi. A ransomware group called BYOD has claimed responsibility and says it stole student and employee data. Vanderbilt has not confirmed the group’s involvement or any data theft.

What Vanderbilt has said

In its incident updates, Vanderbilt says its IT team is investigating and working to contain the incident with government agencies and other partners. Its first message asked everyone to shut down university devices, get off university Wi-Fi and watch for signs of trouble, including:

• unexpected pop-ups, warnings or security notifications
• unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage
• files that were moved, deleted, renamed or changed without explanation
• unfamiliar apps, messages or prompts
• unexpected requests to enter a password or approve a sign-in

Anyone who saw something like that was told not to click anything or try to fix it, to shut the device down right away and to call the IT service desk from another device.

By the evening of November 9, Vanderbilt said campus Wi-Fi was available again but access to most university systems and applications was still restricted. Classes, student services and staff work were to run on a normal schedule on Tuesday, November 10. WSMV reported that Vanderbilt’s health system runs on separate IT systems and has not been impacted.

What the attackers claim

On November 9, BYOD listed Vanderbilt on its data leak site. According to BleepingComputer, the group claims it locked Vanderbilt’s databases, took over its domain controller and stole research data and more than a million Social Security numbers along with names, contact details and student and employee records. BleepingComputer received a photo of a screen showing a BYOD ransom note, and WSMV reported that some students and staff saw a “You have been compromised by BYOD” message when they opened their laptops.

These are a criminal group’s claims, made to pressure the university into paying. They haven’t been verified, and Vanderbilt hasn’t said whether any data was taken. BleepingComputer says BYOD appeared in 2026, and that last month it claimed an attack on the University of New Mexico Health Sciences Center.

What this means for you

If you study or work at Vanderbilt, follow the university’s instructions and use only official channels for updates. If you’re a former student, employee, applicant or research participant, there’s nothing to do yet beyond watching for a formal notice. If personal data was taken, U.S. state breach laws generally require the university to notify the people affected, and that notice should say what was involved.

Incidents like this also attract scammers. Expect fake “Vanderbilt IT” emails asking you to reset a password, approve a sign-in or install a “security tool.”

What you can do

1. Follow Vanderbilt’s official updates on news.vanderbilt.edu, and contact the IT service desk using a number you already know.
2. Don’t approve unexpected sign-in prompts or enter your Vanderbilt password from a link in an email or text.
3. If you reused your Vanderbilt password elsewhere, change it there and turn on multi-factor authentication.
4. If you’re in the U.S. and worried about your SSN, you can place a free credit freeze with the three bureaus now. It’s free and you can lift it any time.
5. Watch for a breach notice in the coming weeks or months, and read it from the original letter or email, not from a forwarded link.

How Frame helps

Vanderbilt hasn’t confirmed that data was taken, so there is no breach record to add yet. If a notice later names what was taken, add it to a verified email in Frame for a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Queens Public Library says ransomware shut down Wi-Fi, computers and the app: another public institution where ransomware disrupted everyday services before anyone knew what was taken.
• Burnaby School District ransomware: what families should know: an education ransomware case where student and staff data was later confirmed.

Sources

• Vanderbilt University, Nov. 9: Active Cybersecurity Incident Updates, November 9, 2026
• BleepingComputer, Vanderbilt University hit in BYOD ransomware attack, data theft claimed, November 2026
• WSMV, Vanderbilt says Wi-Fi is available, online systems restricted after cybersecurity incident, November 10, 2026