Vanderbilt University takes systems offline after cyber incident claimed by BYOD ransomware gang
Vanderbilt University reported an active cyber incident beginning 10:45 CST on November 9, 2026, which took most university systems and applications offline and may affect devices, systems and cloud-based services. The university has not described the nature of the incident or named any perpetrator. The BYOD ransomware group has listed Vanderbilt on its data leak site and claims it locked the university's databases and took a large volume of data, including research data, over one million Social Security numbers, and control of the domain controller; these claims are not confirmed by the university. Classes and student services were set to run normally from November 10 and campus WiFi is available, but access to most systems remains restricted while Vanderbilt IT works with government agencies. The claim follows BYOD's attack on the University of New Mexico Health Sciences Center in late October 2026. Criticity is high: this is an operational outage at a large institution with a claimed mass data theft, but the data claims are unverified and no vulnerability or initial access vector has been named.
Detalhes técnicos
No CVE, initial access vector or malware family has been disclosed. The leak-site claims (per Venarix, as reported by the article) cover locked databases, a large volume of exfiltrated data including over one million SSNs, research data, student and employee records, and a domain controller takeover. Vanderbilt has not confirmed any of these details.
Remediação
Vanderbilt's guidance (infosecurity-magazine.com; fox17.com) asks the community to shut down university devices, disconnect from university WiFi, and watch for unexpected pop-ups or security notifications, unusual changes to files, folders or permissions in cloud storage, and unexpected requests to enter passwords or approve authentication prompts.
Linha do tempo
-
Vanderbilt University takes systems offline after cyber incident claimed by BYOD ransomware gang
ler a análise desta fonte ocultar
Vanderbilt University reported an active cyber incident beginning 10:45 CST on November 9, 2026, which took most university systems and applications offline and may affect devices, systems and cloud-based services. The university has not described the nature of the incident or named any perpetrator. The BYOD ransomware group has listed Vanderbilt on its data leak site and claims it locked the university's databases and took a large volume of data, including research data, over one million Social Security numbers, and control of the domain controller; these claims are not confirmed by the university. Classes and student services were set to run normally from November 10 and campus WiFi is available, but access to most systems remains restricted while Vanderbilt IT works with government agencies. The claim follows BYOD's attack on the University of New Mexico Health Sciences Center in late October 2026. Criticity is high: this is an operational outage at a large institution with a claimed mass data theft, but the data claims are unverified and no vulnerability or initial access vector has been named.
Technical Details
No CVE, initial access vector or malware family has been disclosed. The leak-site claims (per Venarix, as reported by the article) cover locked databases, a large volume of exfiltrated data including over one million SSNs, research data, student and employee records, and a domain controller takeover. Vanderbilt has not confirmed any of these details.
Remediation
Vanderbilt's guidance (infosecurity-magazine.com; fox17.com) asks the community to shut down university devices, disconnect from university WiFi, and watch for unexpected pop-ups or security notifications, unusual changes to files, folders or permissions in cloud storage, and unexpected requests to enter passwords or approve authentication prompts.