Vanderbilt University is responding to an active cybersecurity incident after a ransomware group identifying itself as BYOD claimed to have stolen sensitive personal data — including more than a million social security numbers — and played a video on some affected university devices, according to public reporting. The university has instructed community members to shut down university devices and disconnect from campus Wi‑Fi while its IT team investigates and works to contain the incident.
What attackers claim in the Vanderbilt breach
Ransomware.live reports that the group calling itself BYOD claims to have taken over a million social security numbers as well as names, emails, phone numbers and records for both employees and students. The BYOD name could be heard in a video that played on some breached university devices. Cyber risk protection organization CyberXTron says BYOD is a new ransomware group that first emerged in September and lists an alleged high‑profile victim as Trump Mobile. CyberXTron describes the group’s documented pattern as “data theft followed by publication on a leak site used to pressure victims, run through a dedicated page where stolen data is displayed.”
University response and system status
Vanderbilt initially told its community to shut down university devices, disconnect from university Wi‑Fi and report suspicious activity. The university warned against clicking links, pop‑ups or attachments, attempting to troubleshoot affected devices, or approving unexpected authentication requests. Anyone who notices unusual activity should shut down the device immediately and contact the IT Service Desk from a separate device or by telephone at 615‑343‑9999.
When reached by email, a Vanderbilt spokesperson did not answer questions about whether BYOD is the perpetrator or about the group’s claims to have stolen social security numbers; the university referred inquiries back to its website and said the site will continue to be updated as needed.
Vanderbilt Information Technology is investigating, working to contain the incident and coordinating with government agencies and other partners. By 9 a.m. on Tuesday the university said students, staff and faculty could again access personal accounts, including Google accounts, and that the following systems were available: Campus WiFi; Okta (with a reminder to continue using multi‑factor authentication); Vanderbilt email (Outlook) on Vanderbilt and personal devices; Brightspace; Zoom; and YES (Your Enrollment Services), with sophomore class registration proceeding as scheduled. The university said all other Vanderbilt systems and applications remain restricted, including CampusPrint.
Earlier updates noted campus Wi‑Fi had been restored after the incident affected university devices, systems and cloud‑based services. Vanderbilt said classes on Tuesday, Nov. 10, were expected to operate on a normal schedule, student services and Student Care Network offices were open, and faculty with grant submissions due that week should contact Vice Provost for Research and Innovation Susan Marguiles for support.
Vanderbilt Health said it is aware of a possible incident involving Vanderbilt University’s IT systems, that Vanderbilt University and Vanderbilt Health are legally and financially separate entities, and that Vanderbilt Health was taking precautions to ensure the security of its IT systems, which so far have not been impacted. Vanderbilt Health said it is monitoring the situation closely and that patient care is continuing at all hospital and clinical locations.
Vanderbilt IT reiterated that anyone who notices suspicious activity should not click links or attachments, should shut down affected devices immediately, and should report the incident to the IT Service Desk using a separate device or by phone at 615‑343‑9999.
