E-Paper
Vanderbilt University tells students to disconnect devices after ransomware gang claims theft of 1 million records
Vanderbilt University urges users to shut down computers and stay off campus networks as a ransomware group claims to have stolen sensitive data.
Prefer HTon Google
Vanderbilt University has asked students, faculty and staff to disconnect their devices from the campus network after a suspected ransomware attack disrupted university systems on Monday. A ransomware group calling itself BYOD has claimed responsibility and alleged it stole data belonging to more than one million people associated with the university.
In a separate university notification cited by Axios, Vanderbilt instructed users to “SHUT DOWN YOUR DEVICE IMMEDIATELY” and warned against investigating or attempting to fix the issue independently to reduce further security risks.
“Everyone is following VU protocols and waiting for further instruction,” Blair School of Music Dean Melissa Rose told students in a message shared by the student newspaper The Vanderbilt Hustler. She added that Vanderbilt University Information Technology (VUIT) was working to contain the incident.
Ransomware group claims theft of student, employee data
The ransomware group BYOD posted a message on Ransomware.live, a website that tracks publicly disclosed ransomware incidents. The group claimed that it had encrypted Vanderbilt’s databases and stolen a large volume of sensitive information.
The group alleged it had obtained Social Security numbers, names, email addresses, phone numbers, student and employee records, research data and other information from Vanderbilt’s network. It also claimed to have compromised the university’s domain controller infrastructure.
As of Monday, Vanderbilt had not verified whether any personal information had been accessed or exfiltrated during the attack.
Students using university-issued devices reported seeing multiple ransomware messages appear on their computer desktops. Others reported pop-up notifications linked to the attack.
According to the Nashville Scene, some files stored on university systems were converted into an encrypted “.byod” format which made them inaccessible. One researcher said they had to rely on personal backups after university-hosted research became unavailable.
"Bring Your Own Device"
Cybersecurity experts say universities remain attractive targets because they store large amounts of personal, financial and research data while relying on thousands of connected devices.
The name BYOD appears to reference the cybersecurity term “Bring Your Own Device,” which describes policies allowing users to connect personal devices to institutional networks. Security experts have long warned that such environments increase cyber risks because institutions have limited control over privately owned devices.
According to Axios, the same ransomware group has previously claimed attacks against Michigan State University and the University of New Mexico Health System.
The investigation remains ongoing. University officials are working to restore affected services
