Vanderbilt University hit by BYOD ransomware: systems being restored, over 1 million SSNs claimed stolen, not confirmed by university
Matéria consolidada. Reúne 7 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 12/11/2026 00:02; os links antigos trazem para cá.
Fontes: malwarebytes.com ↗ cyberscoop.com ↗ theregister.com ↗ infosecurity-magazine.com ↗ bleepingcomputer.com ↗
Vanderbilt University in Nashville, Tennessee is responding to a cyberattack attributed to the BYOD ransomware group, which listed the university on its data leak site. BYOD claims to have encrypted databases and stolen sensitive data on students, employees and research, including more than 1 million Social Security numbers and personal records (bleepingcomputer.com, theregister.com, cyberscoop.com, malwarebytes.com). It also threatens to release the data and cause disruption unless the university negotiates (bleepingcomputer.com). As of 10 November 2026, the university had not publicly confirmed data exfiltration or encryption (bleepingcomputer.com, infosecurity-magazine.com, theregister.com), and as of 11 November it still had not confirmed the extent of data access (malwarebytes.com). Systems were partially shut down. Wi-Fi has been partially restored and select services are operational again (theregister.com, cyberscoop.com). On 11 November the university resumed bringing campus systems back online, continues to restrict certain systems, and anticipates several weeks until full restoration (malwarebytes.com).
Detalhes técnicos
- Threat actor: the BYOD ransomware gang claims responsibility through its leak blog (cyberscoop.com) and a data leak site listing (infosecurity-magazine.com).
- Claimed access and impact: BYOD says it holds research data, Social Security numbers, and personal and employee records. It also claims to have taken control of the domain controller (infosecurity-magazine.com) and, per a later report, of backups as well (malwarebytes.com), and to have encrypted databases (bleepingcomputer.com). None of this is independently verified.
- Disruption: the shutdowns affected campus-wide systems including Wi-Fi, email and learning platforms (cyberscoop.com). Campus services such as sporting-event ticketing were also affected (theregister.com).
- Intimidation: reports mention a threatening audio message played on campus computers (theregister.com). This appears in only one source.
Remediação
- The university initially advised staff and students to disconnect from the network and devices to prevent further compromise (bleepingcomputer.com, theregister.com).
- Students and staff are advised to follow official university guidance, remain vigilant against phishing attempts, and keep multifactor authentication enabled on services such as Okta (malwarebytes.com).
- No indicators of compromise, vulnerabilities or initial access vector have been published in the sources.
Relatos divergentes
- Confirmation status: the cyberscoop.com headline says data theft and system disruption were confirmed. Its body attributes the theft figures to BYOD's claims and says officials are still investigating. bleepingcomputer.com, infosecurity-magazine.com and theregister.com all state that Vanderbilt has not confirmed exfiltration or encryption, and malwarebytes.com (11 November, more recent) likewise says the extent of data access is unconfirmed. Treat the data-theft claims as unconfirmed by the university. Only the system disruption is clearly established.
- Recovery status: infosecurity-magazine.com and theregister.com (10 November) describe systems as largely restricted. cyberscoop.com reports that select services are operational again. malwarebytes.com, the most recent source (11 November), says restoration is under way but some systems stay restricted, with several weeks expected until full restoration.
Linha do tempo
-
Vanderbilt University restores systems after BYOD ransomware cyberattack with claimed data theft
ler a análise desta fonte ocultar
Vanderbilt University has resumed bringing its campus systems back online following a cyberattack by the BYOD ransomware group, which claims to have encrypted databases and stolen over one million Social Security numbers along with other personal and research data. The university has not yet confirmed the extent of data access and continues to restrict certain systems, anticipating several weeks until full restoration. The attackers reportedly control a domain controller and backups. Students and staff are advised to follow official guidance, remain vigilant against phishing attempts, and maintain multifactor authentication on services like Okta.
-
Vanderbilt University hit by BYOD ransomware; data theft and system disruption confirmed
ler a análise desta fonte ocultar
Vanderbilt University in Nashville, Tennessee experienced a ransomware attack attributed to the BYOD group, which claims to have stolen over one million social security numbers and personal data. The attack led to partial shutdowns of campus-wide systems, including WiFi, email, and learning platforms. University officials reported that select services are now operational again as they continue to investigate the breach. The BYOD hackers have posted threats and claimed responsibility via their leak blog, emphasizing the severity of the incident and the risk of exfiltrated data being released.
-
Vanderbilt University's Systems Remain Restricted After BYOD Ransomware Attack
ler a análise desta fonte ocultar
Vanderbilt University is managing an active cybersecurity incident attributed to the ransomware group BYOD, which claims to have encrypted systems and exfiltrated extensive data. The university initially advised disconnecting devices from the network, and reports indicate a threatening audio message played on campus computers. While Wi-Fi access has been partially restored, most systems remain restricted, affecting campus services including ticketing for sporting events. BYOD alleges to have stolen over 1 million records, including SSNs and student data, though Vanderbilt has not officially confirmed these claims. The attack underscores ongoing cybersecurity risks faced by higher education institutions.
-
Vanderbilt University Hit by Ransomware, Data Leaked by BYOD Group
ler a análise desta fonte ocultar
Vanderbilt University has experienced a cyber incident linked to the BYOD ransomware gang, which claims to have encrypted systems and leaked sensitive data. University systems remain restricted, affecting campus services and operations. The ransomware group has listed Vanderbilt on its data leak site, claiming access to research data, social security numbers, personal and employee records, and taking control of the domain controller. The university has not confirmed data exfiltration or encryption, but ongoing investigations and threat actor claims suggest a serious breach.
-
Vanderbilt University ransomware attack claimed by BYOD gang, data theft suspected
ler a análise desta fonte ocultar
Vanderbilt University is responding to a cyberattack attributed to the BYOD ransomware group, which claims to have encrypted the university's databases and stolen sensitive data of students, employees, and research. The university has advised staff and students to disconnect from network and devices to prevent further compromise, but has not confirmed whether data was exfiltrated or systems encrypted. The BYOD gang claims to hold over 1 million SSNs and personal records, threatening to release data and cause disruption unless negotiations are made.