Threat watch / Attack
Vanderbilt University: a cybersecurity incident cuts access to campus systems
Vanderbilt University in Nashville said on November 9, 2026 that it was responding to an active cybersecurity incident affecting university devices, systems and cloud-based services. It told staff to shut down university devices and disconnect from campus Wi-Fi. By the evening Wi-Fi was back, but access to most systems and applications stayed restricted. A ransomware group calling itself BYOD claims the attack and says it took student and employee records; Vanderbilt has not confirmed any data theft or named who is behind it.
- Sector
- Education
- Way in
- Not public yet
- Product or vendor
- None named
- Social Security numbers and student and employee records claimed by the BYOD group (unverified)[5]
- 1M+
- How it happened
- Not public yet Checked 14 Nov 2026
- What was stolen
- Not public yet Checked 14 Nov 2026
- Who was impacted
- The university's students and staff: Vanderbilt says the incident affects university devices, systems and cloud-based services, and access to most systems and applications remains restricted. It has not given a number of people. Vanderbilt Health says its own IT systems are unaffected.[1][3] Checked 14 Nov 2026
- Threat actor
- Not attributed. Claimed by a ransomware group calling itself BYOD, which listed the university on its leak site, according to The Record and FOX 17. Vanderbilt has not identified who is behind the incident.
Timeline
- At 10:45 a.m., Vanderbilt says it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services, and asks staff to shut down university devices and disconnect from university Wi-Fi. [1]
- Claim: the BYOD ransomware group adds the university to its leak site and says it obtained student and employee records, including Social Security numbers, locked databases and took control of part of the network. Neither Vanderbilt nor the reporters have verified these claims. [2][3]
- Claim: according to Gizmodo, BYOD's note says it holds "Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records" and "your entire estate and research data". Gizmodo says it is not clear how much data was lost; Vanderbilt has not confirmed any theft. [5]
- At 7:15 p.m., campus Wi-Fi is back but access to most systems and applications remains restricted. Vanderbilt IT says it is working with government agencies and other partners; classes and services are to run normally on November 10. [1][3]
- At 9 a.m., Vanderbilt calls it an ongoing "cybersecurity hacking incident". Wi-Fi, Okta, Outlook email, Brightspace, Zoom and course registration are available again; all other systems stay restricted. [1][4]
- At 6 p.m., Vanderbilt says it is focused on containment and on "determining what data, if any, may have been accessed", and that it may take multiple weeks to fully restore normal operations. Staff and students may use university devices again. [1]
- At 1 p.m., Vanderbilt says it is working with government agencies, law enforcement and external partners on containment, and that restoring all systems may take multiple weeks. It is prioritizing payroll, payment services, admissions, course registration and public safety. It still says nothing on how the attackers got in or what data was taken. [1]
- At 3:50 p.m., Vanderbilt says a password reset is "required as part of the ongoing cyberattack remediation": all students, faculty, staff and postdocs must update their password to access university systems. [1]
- At 11:50 a.m., Vanderbilt says "the majority of Vanderbilt systems and applications are now available for use", including Oracle and Salesforce. OneDrive, SharePoint and Box stay disabled, and files can only be saved locally. It still gives no entry point and has not confirmed what data was taken. [1]