Vanderbilt University confirms active cyber incident as BYOD ransomware gang claims encryption and data theft
Vanderbilt University confirmed on Monday an active cybersecurity incident that may affect university devices, systems and cloud-based services, and its IT team is working to contain it (bleepingcomputer.com). The BYOD ransomware gang claimed the attack on its leak site, saying it had locked the university's databases and taken student, employee and research records, including over one million SSNs; these are the group's own claims and the university has not confirmed them (bleepingcomputer.com). Vanderbilt has not disclosed the nature of the attack, whether systems were encrypted or whether any data was stolen. BYOD is a group that launched in 2026, lists five other organizations on its leak site, and claimed an attack on the University of New Mexico Health Sciences Center last month (bleepingcomputer.com). No CVE, initial access vector or patch is named in the reporting, so the exposure is operational and data-breach risk rather than a confirmed software flaw. Criticity is high because this is active ransomware against a large university with claimed mass theft of personal data.
Detalhes técnicos
- The ransom note is named README_BYOD_31.txt and points to the BYOD leak site and to the SESSION messaging platform for negotiation; BleepingComputer confirmed the leak-site link (bleepingcomputer.com).
- A photograph of an alleged infected screen shows Vanderbilt-associated icons, and a video shows infected devices playing audio that says the network is compromised by BYOD (bleepingcomputer.com).
- The BYOD note claims the attackers hold the backups as well as the network, and it threatens to release data and cause further disruption if the university does not negotiate (bleepingcomputer.com).
- The student paper The Vanderbilt Hustler reported that Wi-Fi networks had a security issue according to faculty and staff contacted by VUIT, while VUIT had not confirmed a breach (vanderbilthustler.com).
Remediação
- Vanderbilt told users to shut down university devices, disconnect from university Wi-Fi and watch for unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar applications and unexpected authentication requests (bleepingcomputer.com).
- Users who see these signs were told not to troubleshoot on their own but to shut down the device and contact the university IT service desk (bleepingcomputer.com).
- Defenders in similar environments should check backups for integrity and isolation, since the group claims to have reached them; this is a general recommendation, not a university statement.
Linha do tempo
-
Vanderbilt University confirms active cyber incident as BYOD ransomware gang claims encryption and data theft
ler a análise desta fonte ocultar
Vanderbilt University confirmed on Monday an active cybersecurity incident that may affect university devices, systems and cloud-based services, and its IT team is working to contain it (bleepingcomputer.com). The BYOD ransomware gang claimed the attack on its leak site, saying it had locked the university's databases and taken student, employee and research records, including over one million SSNs; these are the group's own claims and the university has not confirmed them (bleepingcomputer.com). Vanderbilt has not disclosed the nature of the attack, whether systems were encrypted or whether any data was stolen. BYOD is a group that launched in 2026, lists five other organizations on its leak site, and claimed an attack on the University of New Mexico Health Sciences Center last month (bleepingcomputer.com). No CVE, initial access vector or patch is named in the reporting, so the exposure is operational and data-breach risk rather than a confirmed software flaw. Criticity is high because this is active ransomware against a large university with claimed mass theft of personal data.
Technical Details
- The ransom note is named README_BYOD_31.txt and points to the BYOD leak site and to the SESSION messaging platform for negotiation; BleepingComputer confirmed the leak-site link (bleepingcomputer.com).
- A photograph of an alleged infected screen shows Vanderbilt-associated icons, and a video shows infected devices playing audio that says the network is compromised by BYOD (bleepingcomputer.com).
- The BYOD note claims the attackers hold the backups as well as the network, and it threatens to release data and cause further disruption if the university does not negotiate (bleepingcomputer.com).
- The student paper The Vanderbilt Hustler reported that Wi-Fi networks had a security issue according to faculty and staff contacted by VUIT, while VUIT had not confirmed a breach (vanderbilthustler.com).
Remediation
- Vanderbilt told users to shut down university devices, disconnect from university Wi-Fi and watch for unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar applications and unexpected authentication requests (bleepingcomputer.com).
- Users who see these signs were told not to troubleshoot on their own but to shut down the device and contact the university IT service desk (bleepingcomputer.com).
- Defenders in similar environments should check backups for integrity and isolation, since the group claims to have reached them; this is a general recommendation, not a university statement.