"The cyberattack is like a building that just exploded and we are trying to gather the pieces," a Vanderbilt IT representative said, according to the Hustler.
BYOD claims responsibility and a sweeping data haul
A ransomware group that calls itself BYOD posted a claim on its leak blog taking responsibility for the intrusion at Vanderbilt University in Nashville, Tennessee. The group, which the university says emerged in September, has since claimed responsibility for multiple attacks on academic and health-care institutions; the source cites a separate incident last month at the University of New Mexico Health Sciences Center where the attack caused system outages, disrupted patient care and affected academics. In the Vanderbilt case BYOD posted a claim that it has more than one million Social Security numbers from the attack.
Services taken offline, then partially restored
The university initially ordered community members to shut down university devices and disconnect from campus Wi‑Fi while the IT team "actively investigat[ed] and work[ed] to contain the situation," according to the institution's social media notice. By Tuesday morning, Vanderbilt shared an update saying select campus‑wide systems and applications were safe to use again, specifically naming campus WiFi, Okta, Outlook, Brightspace, Zoom and YES. Other services remained restricted; the university singled out CampusPrint as still unavailable. Students, faculty and staff were allowed to resume use of Vanderbilt devices after the shutdown order the previous day.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildUniversity guidance to users and ongoing investigation
Vanderbilt Information Technology told the community to watch for signs of account or device compromise and to take immediate action if they observed unusual activity. The advisory listed specific indicators: unexpected pop‑ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms; unexpected file movement, deletion, renaming or modification; unfamiliar applications, messages or prompts; and unexpected requests to enter passwords, approve authentication requests or provide login credentials. The university said it "continues to work with government agencies and other partners to manage this situation, and we will continue to send updates today and throughout this week for as long as necessary."
Student leaders press for clearer communication and academic protections
Student Government President Simran Fitzpatrick and Vice President William Dean told The Hustler they had met with Vanderbilt Student Affairs to convey student frustration over the university's handling and communications. "Students are concerned about the cyberattacks and extortion threats, particularly what information was stolen, how it may be used, and how it could affect them personally," Fitzpatrick and Dean said. They added that ensuring timely updates and protecting students from academic penalties related to the disruption were priorities.
How technologists, students, and government partners are responding
- Technologists and security teams: Vanderbilt IT is containing the incident, selectively restoring services and monitoring for indicators of compromise while coordinating with government partners, per the university's update.
- Students and faculty: Community members were instructed to power down devices and disconnect from campus Wi‑Fi during early containment; they were later allowed to resume device use and are being asked to report unusual account or file behavior immediately.
- Government agencies and other partners: The university has stated it is working with government agencies and other partners on the response and will continue providing updates throughout the week.
Vanderbilt's comparison of the incident to an exploded building underscores how rapidly a campus's digital life can be disrupted. BYOD's public claim of more than one million Social Security numbers raises the stakes on verification and remediation; the university's ongoing containment, service restorations and repeated commitments to update the community will shape how that claim and its consequences are sorted in the days ahead.
