Vanderbilt University hit by active cyber incident; BYOD ransomware gang claims encryption and theft of over 1 million SSNs
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 10/11/2026 12:13; os links antigos trazem para cá.
Fontes: theregister.com ↗ infosecurity-magazine.com ↗ bleepingcomputer.com ↗
Vanderbilt University confirmed an active cybersecurity incident that began at 10:45 CST on November 9, 2026 and took most university systems and applications offline. It may affect devices, systems and cloud-based services (bleepingcomputer.com; infosecurity-magazine.com). The BYOD ransomware group, which launched in 2026, listed the university on its leak site. It claims to have locked databases and stolen student, employee and research records, including over one million Social Security numbers, plus control of the domain controller. The university has not confirmed the nature of the attack, any encryption, any data theft or BYOD's involvement (bleepingcomputer.com; theregister.com). As of November 10, classes and student services continue and campus Wi-Fi is back, but access to most systems remains restricted and the Athletics ticketing system is down. Vanderbilt IT is working with government agencies (infosecurity-magazine.com; theregister.com). The claim follows BYOD's attack on the University of New Mexico Health Sciences Center in October 2026. BYOD also claims Texas Health and Human Services, which has not publicly confirmed an incident (theregister.com). Severity is high: this is an outage at a large institution with claimed mass theft of personal data, but the data claims are unverified.
Detalhes técnicos
- No CVE, initial access vector, vulnerability or patch has been named, so the intrusion method is unknown (bleepingcomputer.com; infosecurity-magazine.com; theregister.com).
- The ransom note is named README_BYOD_31.txt. It points to the BYOD leak site and to the SESSION messaging platform for negotiation, and BleepingComputer confirmed the leak-site link (bleepingcomputer.com).
- The note claims the attackers hold the backups as well as the network, and threatens to release data and cause further disruption if the university does not negotiate (bleepingcomputer.com).
- A photo of an alleged infected screen shows Vanderbilt-associated icons. A video shows infected devices playing audio saying the network is compromised by BYOD. The message asks users to make contact and says instructions were left on the desktop (bleepingcomputer.com; theregister.com).
- The leak-site post claims locked databases, the whole estate and research data, and full takeover of the domain controller. Infosecurity-magazine.com attributes these claims to Venarix as reported in its article. All of them are unconfirmed by the university.
- The student paper The Vanderbilt Hustler reported, citing faculty and staff contacted by VUIT, that Wi-Fi networks had a security issue. VUIT had not confirmed a breach (vanderbilthustler.com, as cited by bleepingcomputer.com).
- BYOD lists five other organizations on its leak site (bleepingcomputer.com).
Remediação
- Vanderbilt told users to shut down university devices and disconnect from university Wi-Fi (bleepingcomputer.com; infosecurity-magazine.com; theregister.com; news.vanderbilt.edu).
- Users should watch for unexpected pop-ups or security notifications, unusual changes to files, folders, cloud files or permissions, missing or modified files, unfamiliar applications, and unexpected password or authentication prompts.
- Users who see these signs should not troubleshoot on their own. They should shut down the device and contact the university IT service desk (bleepingcomputer.com).
- Defenders in similar environments should check that backups are intact and isolated, since the group claims to have reached them. This is a general recommendation, not a university statement.
- No vendor patch applies, because no software flaw has been identified (theregister.com).
Relatos divergentes
- Wi-Fi guidance: The earlier guidance, reported by bleepingcomputer.com, told users to disconnect from university Wi-Fi. The Register (theregister.com) quotes the university (news.vanderbilt.edu) as telling users to avoid campus Wi-Fi, yet also says Wi-Fi is now available. Infosecurity-magazine.com likewise says campus WiFi is available. The later reports (November 10) are more current: Wi-Fi is back, but the shutdown and caution guidance for devices was still being repeated.
- Attribution and impact: BYOD's responsibility, the encryption, the data theft and the over one million SSNs rest only on the group's own claims. All three outlets say the university has not confirmed them.
Linha do tempo
-
BYOD ransomware gang claims Vanderbilt University breach as campus systems stay restricted
ler a análise desta fonte ocultar
Vanderbilt University is responding to an active cybersecurity incident that affects university devices, systems and cloud-based services, and the BYOD ransomware group has claimed responsibility. The group says it locked the university's databases and holds over 1 million Social Security numbers along with student, employee and research records. Vanderbilt has confirmed the incident but has not confirmed the claimed encryption, the data theft or BYOD's involvement. Campus Wi-Fi is back and classes continue as scheduled, but access to most university systems remains restricted and the Athletics ticketing system is down. BYOD also claims an attack on Texas Health and Human Services, which has not publicly confirmed any incident.
Technical Details
Campus computers reportedly displayed an audio message attributed to BYOD, telling users they had been compromised, asking them to make contact, and saying instructions were left on the desktop. The group's leak-site post says its victims' databases are locked and that it possesses the whole estate and research data, including full takeover of the domain controller. No vulnerability, CVE, initial access vector or malware family has been named by the university or in the article, so the intrusion method is unknown.
Remediation
Vanderbilt told students and staff to shut down university devices and avoid campus Wi-Fi, and to watch for unexpected prompts, altered files or permissions, unfamiliar applications and unsolicited authentication requests (news.vanderbilt.edu). The university said Campus Wi-Fi is now available while access to most systems and applications remains restricted (news.vanderbilt.edu). No vendor patch applies, because no software flaw has been identified.
-
Vanderbilt University takes systems offline after cyber incident claimed by BYOD ransomware gang
ler a análise desta fonte ocultar
Vanderbilt University reported an active cyber incident beginning 10:45 CST on November 9, 2026, which took most university systems and applications offline and may affect devices, systems and cloud-based services. The university has not described the nature of the incident or named any perpetrator. The BYOD ransomware group has listed Vanderbilt on its data leak site and claims it locked the university's databases and took a large volume of data, including research data, over one million Social Security numbers, and control of the domain controller; these claims are not confirmed by the university. Classes and student services were set to run normally from November 10 and campus WiFi is available, but access to most systems remains restricted while Vanderbilt IT works with government agencies. The claim follows BYOD's attack on the University of New Mexico Health Sciences Center in late October 2026. Criticity is high: this is an operational outage at a large institution with a claimed mass data theft, but the data claims are unverified and no vulnerability or initial access vector has been named.
Technical Details
No CVE, initial access vector or malware family has been disclosed. The leak-site claims (per Venarix, as reported by the article) cover locked databases, a large volume of exfiltrated data including over one million SSNs, research data, student and employee records, and a domain controller takeover. Vanderbilt has not confirmed any of these details.
Remediation
Vanderbilt's guidance (infosecurity-magazine.com; fox17.com) asks the community to shut down university devices, disconnect from university WiFi, and watch for unexpected pop-ups or security notifications, unusual changes to files, folders or permissions in cloud storage, and unexpected requests to enter passwords or approve authentication prompts.
-
Vanderbilt University confirms active cyber incident as BYOD ransomware gang claims encryption and data theft
ler a análise desta fonte ocultar
Vanderbilt University confirmed on Monday an active cybersecurity incident that may affect university devices, systems and cloud-based services, and its IT team is working to contain it (bleepingcomputer.com). The BYOD ransomware gang claimed the attack on its leak site, saying it had locked the university's databases and taken student, employee and research records, including over one million SSNs; these are the group's own claims and the university has not confirmed them (bleepingcomputer.com). Vanderbilt has not disclosed the nature of the attack, whether systems were encrypted or whether any data was stolen. BYOD is a group that launched in 2026, lists five other organizations on its leak site, and claimed an attack on the University of New Mexico Health Sciences Center last month (bleepingcomputer.com). No CVE, initial access vector or patch is named in the reporting, so the exposure is operational and data-breach risk rather than a confirmed software flaw. Criticity is high because this is active ransomware against a large university with claimed mass theft of personal data.
Technical Details
- The ransom note is named README_BYOD_31.txt and points to the BYOD leak site and to the SESSION messaging platform for negotiation; BleepingComputer confirmed the leak-site link (bleepingcomputer.com).
- A photograph of an alleged infected screen shows Vanderbilt-associated icons, and a video shows infected devices playing audio that says the network is compromised by BYOD (bleepingcomputer.com).
- The BYOD note claims the attackers hold the backups as well as the network, and it threatens to release data and cause further disruption if the university does not negotiate (bleepingcomputer.com).
- The student paper The Vanderbilt Hustler reported that Wi-Fi networks had a security issue according to faculty and staff contacted by VUIT, while VUIT had not confirmed a breach (vanderbilthustler.com).
Remediation
- Vanderbilt told users to shut down university devices, disconnect from university Wi-Fi and watch for unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar applications and unexpected authentication requests (bleepingcomputer.com).
- Users who see these signs were told not to troubleshoot on their own but to shut down the device and contact the university IT service desk (bleepingcomputer.com).
- Defenders in similar environments should check backups for integrity and isolation, since the group claims to have reached them; this is a general recommendation, not a university statement.