Vanderbilt University told students, faculty and staff to shut down university devices and get off campus Wi-Fi on Monday, November 9, 2026, as it responded to what it called an active cybersecurity incident affecting university devices, systems and cloud-based services. The BYOD ransomware gang listed the Nashville university on its leak site the same day, claiming it had locked university databases and stolen student, employee and research data.
Vanderbilt has not confirmed that ransomware was involved, has not named BYOD, and has not said whether any data was taken. The gang’s claims have not been independently verified.
A Monday morning shutdown order
In a statement posted at 10:45 a.m. Central Time, the university said its Information Technology team was “actively investigating and working to contain the situation.” It asked everyone to shut down university devices, disconnect from university Wi-Fi and “remain extremely vigilant.”
The notice listed warning signs that point to an active intrusion rather than a simple outage:
- Unexpected pop-ups, warnings or security notifications
- Unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage
- Files that were moved, deleted, renamed or modified without explanation
- Unexpected requests to enter passwords or approve sign-ins
Anyone who saw that kind of activity was told not to click anything, not to try to fix the problem, to shut the device down right away and to call the IT service desk from a separate device.
What people saw on their screens
According to The Vanderbilt Hustler, the student newspaper, IT staff walked into classrooms to warn faculty that school-issued computers were not safe to use. A criminology professor told the paper her university laptop showed about 40 documents labeled “Read Me” and played a spoken message in the middle of class.
WSMV in Nashville reported that some students and staff opened their laptops to a message reading “You have been compromised by BYOD,” which told them to follow instructions left on the desktop. Pop-up notes and instruction files of this kind are a common sign that ransomware ran on a device.
Wi-Fi back, most systems still restricted
In a 7:15 p.m. update, Vanderbilt said campus Wi-Fi was available again but that access to most university systems and applications remained restricted. The university said Vanderbilt IT is working with government agencies and other partners and acknowledged that the disruption had “caused frustration across the university.”
Classes and student services are running on a normal schedule on Tuesday, November 10. Faculty were asked to teach as planned, and researchers with grant submissions due this week were pointed to the Office of the Vice Provost for Research and Innovation for help meeting deadlines. The university promised its next update, including the status of systems and applications, by 9 a.m. Central Time on Tuesday.
The Hustler reported that, according to a Monday night call with university IT, the Brightspace learning platform and the YES student system were considered safe to use, while OneDrive and Dropbox remained compromised. Students were told not to sign in to Microsoft services if prompted for credentials.
Vanderbilt University Medical Center runs on separate IT systems and has not been affected, according to WSMV, though the health system is taking precautions. VUMC is a separate organization from the university.
BYOD’s claims about the university
On its leak site, BYOD alleges that Vanderbilt’s databases are “locked” and that it holds the university’s “entire estate and research data.” The gang claims the haul includes more than 1 million Social Security numbers along with names, email addresses, phone numbers, and student and employee records. It also claims a “full takeover” of the university’s domain controller, the server that manages accounts and sign-ins across a Windows network.
BreachNews has not reviewed any data tied to the claim. Extortion groups often inflate record counts to pressure victims during negotiations.
Vanderbilt Student Government leaders told the Hustler that students are worried about what information was stolen and how it could be used, and criticized what they called the university’s “lack of clear communication.”
A fall campaign against universities
BYOD has moved quickly through higher education this fall. The group listed the University of New Mexico after an October 26 cyberattack that forced UNM Health to divert ambulances and cancel clinic appointments. It then claimed Michigan State University on November 1, alleging it held data on more than 1 million current and former students. Neither university has confirmed the group’s data theft claims.
What the Vanderbilt community should do now
- Follow the university’s official update page and AlertVU messages rather than links in emails or texts.
- Do not enter your VUnetID password into unexpected Microsoft or sign-in prompts until IT says systems are clear.
- Expect phishing that references the incident, and verify any request for credentials or payment by phone.
- If BYOD’s Social Security number claim is confirmed, place a free credit freeze with Equifax, Experian and TransUnion.
Vanderbilt had not issued any public statement about BYOD’s claims or the type of attack at time of publication. This article reflects information available at the time of publication.
