Overview
Vanderbilt University confirmed on Monday, November 9, 2026, that it is responding to an active cybersecurity incident affecting university devices, systems, and cloud-based services. The BYOD ransomware gang has claimed the attack on its leak site.
What Vanderbilt Has Said
In a statement on X, the university said its IT team is investigating and working to contain the incident. Students, faculty, and staff were told to:
- Shut down university devices
- Disconnect from university Wi-Fi
- Watch for suspicious activity
- Avoid troubleshooting on their own and contact the IT service desk
Vanderbilt has not disclosed the nature of the attack, confirmed that systems were encrypted, or confirmed that data was stolen.
The Gang's Claims
BYOD says it encrypted the university's databases and stole sensitive student, employee, and research data. Its leak-site post claims "Over 1 Million SSNs" and says it holds the university's "entire estate and research data."
BleepingComputer received a photo of a screen showing a ransom note named README_BYOD_31.txt, which links to the gang's leak site and lists contact details on the SESSION messenger. These claims are unverified.
About BYOD
BYOD is a new ransomware operation that emerged in 2026. Its leak site lists five other victims. Last month it claimed an attack on the University of New Mexico Health Sciences Center, which caused outages and disrupted patient care.
Recommendations
- Affected individuals: treat unexpected emails, calls, and texts as potentially phishing, and consider a credit freeze if the SSN claim is confirmed.
- Universities and similar organizations: review network segmentation between research, student, and administrative systems, and confirm offline, tested backups.
- Watch for official updates from Vanderbilt before acting on leak-site claims.