Vanderbilt University officials said Monday evening that information technology staff were working with government agencies and other partners to manage the fallout from a major cyberattack that shut down the school’s digital networks. Campus WiFi had been restored, but “access to most Vanderbilt systems and applications remains restricted,” and staff, faculty and students were told to return to work and class as scheduled on Tuesday.
Vanderbilt cyberattack: scope and immediate effects
Earlier on Monday the university confirmed it was investigating and trying to contain an “active cybersecurity incident,” urging faculty and staff to “shut down university devices, disconnect from university WiFi, and remain extremely vigilant.” The school posted a statement saying the breach could “impact university devices, systems, and cloud-based services.”
Vanderbilt Health said its hospital and clinical facilities had not been impacted and that officials were “proceeding with the utmost care and diligence.”
One university employee described seeing a notification that the computer was running a “system update,” followed by a message that old files were being deleted, then a warning about a ransomware attack with a link for more information; the employee said all the computer’s files then became “.byod” files.
A faculty member reported that the first signs of trouble came when staff received notifications that files stored in the cloud platform Box had been deleted by administrators who confirmed they had not accessed them. Initial missing files reportedly included accreditation information and admissions procedures.
Multiple employees said the IT help line for university staff “had crashed,” and several said they had not received guidance beyond the university’s public statement. Students were notified of the ongoing incident more than an hour and a half after faculty, according to the student newspaper.
Attribution and recent BYOD activity
The ransomware group BYOD appears to have claimed responsibility for the attack based on messages attributed to them online. The group has also recently claimed responsibility for attacks on Michigan State University and the University of New Mexico Health System, saying it accessed “1 million [Social Security numbers], full names, email addresses, phone numbers, student & employee records.”
After its attack on the University of New Mexico Health System, the group reportedly apologized when it realized the incident affected some systems used to help patients and even offered financial compensation; the university warned that the offer of assistance could itself be another scam. In a statement attributed to BYOD in that case the group wrote: “We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That’s the whole reason why we came about and we plan to keep it that way.”
