Security · November 12, 2026
Also published in 한국어
Vanderbilt University hit by ransomware attack affecting millions of sensitive records
Vanderbilt University is responding to an ongoing cybersecurity incident that has potentially compromised university devices, internal systems, and multiple cloud services. The university has instructed students, faculty, and staff to power down university-issued equipment, disconnect from campus wireless networks, and monitor devices for suspicious activity.
The university's information technology team is investigating the incident and working to contain its spread. The university has warned the campus community to remain vigilant and report any suspicious activity immediately. Warning signs include unexpected pop-ups, security warnings, unusual changes to files or permissions in cloud storage platforms, unexplained file deletions or renaming, unfamiliar applications on devices, and anomalous authentication requests.
The university has advised users not to click unknown links, pop-ups, or attachments and not to attempt to investigate or repair problems independently. Information technology staff have visited classrooms to remind instructors to stop using university-issued devices. The university has also recommended that students and faculty close all open Microsoft Word documents and stop accessing online storage directories including OneDrive and Dropbox.
Despite the attack, the university stated that teaching will continue as scheduled. Courses will proceed normally, and students should follow their instructors' specific guidance. Student support services including counseling remain operational.
A ransomware group calling itself BYOD has claimed responsibility for the attack. The group claims to have successfully breached the university network and stolen sensitive data including social security numbers, names, email addresses, phone numbers, and student and employee records. The group claims to have obtained more than one million social security numbers and states that university databases have been locked and that attackers control numerous network assets and information.
Students and faculty reported seeing ransom messages related to the BYOD group on university devices. A video circulating online shows a campus computer automatically playing a voice warning stating that the system has been compromised by the group.
However, the group's claims about the scale and content of stolen data have not been independently verified. The university's latest updates indicate that campus wireless networks and core digital services including Brightspace and YES are currently functioning normally. Some online storage platforms remain at risk, and the university has advised students not to log into any Microsoft service accounts when receiving authentication requests to prevent credential theft.
The university has not provided a timeline for resolving the incident and plans to continue issuing updates and regularly reporting investigation results to the campus community.