"We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services," Vanderbilt University said in a statement on X.
Vanderbilt University response to an active incident
The university confirmed the incident on Monday and advised students, faculty, and staff to shut down university devices, disconnect from university Wi‑Fi, and remain alert for suspicious activity. Vanderbilt's Information Technology team, the statement said, is "actively investigating and working to contain the situation." The university has not publicly disclosed the technical nature of the intrusion nor confirmed whether any data were stolen or systems encrypted.
Claims posted by the BYOD ransomware group
The ransomware gang calling itself BYOD posted an entry on its data leak site claiming it had encrypted Vanderbilt's databases and stolen "sensitive information belonging to students and employees." The post on the group's site, quoted by BleepingComputer, reads: "If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess."
The ransom note associated with the claim — a file named README_BYOD_31.txt — includes a link to the BYOD data leak site and provides contact details for the SESSION encrypted messaging platform for negotiation. The note warns it will release stolen data and cause further disruption if the university does not negotiate.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadEvidence collected by BleepingComputer
BleepingComputer received a photograph described as showing an alleged computer screen with Vanderbilt-associated icons and a BYOD ransom note (README_BYOD_31.txt). The site also received a video showing infected devices apparently playing audio that says the network has been compromised by "BYOD." BleepingComputer confirmed the ransom-note link points to the site operated by BYOD and contacted Vanderbilt with questions including whether systems were encrypted, what data may have been stolen, and whether the incident has been contained.
What the university told campus to watch for
Vanderbilt warned community members that signs of compromise may include unexpected pop‑ups or security notifications; unusual changes to files or permissions in cloud storage platforms; missing or modified files; unfamiliar applications; and unexpected authentication requests. The university instructed anyone who notices suspicious activity not to investigate or troubleshoot on their own but instead to immediately shut down affected devices and contact the university's IT service desk.
Who BYOD is and its recent activity
According to the reporting, BYOD is a relatively new ransomware gang that launched in 2026 and currently lists five other organizations on its data leak site. Last month the group claimed responsibility for an attack on the University of New Mexico Health Sciences Center that, the gang said, caused system outages and disrupted patient care and academic activities.
What this means for students, employees, and researchers
- Students and employees: The group explicitly named "student & employee records" and alleged possession of "Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers," heightening the risk to personal data if the claim is accurate. The university's guidance places immediate, short‑term actions on individuals: power down devices, disconnect from university Wi‑Fi, and report incidents to the IT service desk.
- Researchers and research administrators: BYOD's claim of holding "entire estate and research data" and backups — if substantiated — raises risks to ongoing projects and intellectual property; the ransom note asserts the attackers possess backups as well as live data.
The record as reported shows a contested, developing incident: a university working to contain an active cybersecurity event, and a ransomware group publicly claiming a large haul of sensitive records and network control. Vanderbilt has not independently confirmed those claims, and BleepingComputer has sought answers from the university about encryption, data theft, and containment. The attackers' public threats to publish stolen material and the presence of an active notification to campus make containment and communication the immediate priorities.
If you have information about this incident or other undisclosed attacks, BleepingComputer invited confidential tips via Signal at 646‑961‑3731 or at tips@bleepingcomputer.com.
