Vanderbilt University tells campus to shut down devices as BYOD ransomware group claims data theft

What happened

Vanderbilt University in Nashville, Tennessee, said on the morning of November 9, 2026, that it was responding to "an active cybersecurity incident that may affect university devices, systems and cloud-based services." It asked all members of the university community to "shut down university devices, disconnect from university Wi-Fi and remain extremely vigilant," according to its incident updates page. BleepingComputer and WSMV reported the same instructions.

University staff described the first signs to the Nashville Banner. A faculty member said staff received notifications that files in the cloud storage platform Box had been deleted by administrators who said they had not touched them. An employee said a warning about a ransomware attack appeared on her computer, after which all of its files became ".byod" files.

A video shared on YouTube showed infected devices playing an audio warning that the network had been compromised by "BYOD," BleepingComputer reported. By November 10, Vanderbilt was calling the event an "ongoing cybersecurity hacking incident."

What the BYOD group claims

The BYOD ransomware group claimed responsibility on its data leak site, saying it had encrypted Vanderbilt's databases and stolen student, employee, and research data, BleepingComputer reported. The group claims to hold more than 1 million Social Security numbers, full names, email addresses, phone numbers, and student and employee records, according to BleepingComputer, the Nashville Banner, and WSMV.

BleepingComputer said it received a photograph of a BYOD ransom note on a computer showing Vanderbilt University icons. The note threatens to release stolen data and cause further disruption if the university does not negotiate.

Vanderbilt has not publicly disclosed the nature of the attack or confirmed whether any data was stolen, BleepingComputer reported. On November 10, a Vanderbilt spokesperson did not answer WSMV's questions about whether BYOD was behind the attack or about its claim to have stolen Social Security numbers, and referred the station to the university's website.

BYOD emerged in September 2026, according to CyberScoop. In October, the group claimed an attack on the University of New Mexico Health Sciences Center that caused system outages and disrupted patient care, CyberScoop and BleepingComputer reported. The Nashville Banner reported that BYOD has also claimed an attack on Michigan State University.

Disruption on campus

Campus Wi-Fi returned on the evening of November 9, but access to most university systems stayed restricted, Vanderbilt said. The university said classes would run on a normal schedule on November 10 and asked students to contact their instructors about flexibility on coursework deadlines.

At 9 a.m. on November 10, Vanderbilt said campus Wi-Fi, the Okta sign-in service, Outlook email, the Brightspace learning platform, Zoom, and its YES enrollment system were available, and that sophomore class registration was going ahead as scheduled. Students, faculty, and staff could use Vanderbilt devices again. "All other Vanderbilt systems and applications are still restricted, including CampusPrint," the university said.

On the night of November 9, students went to nearby coffee shops for Wi-Fi, and several said they struggled to complete assignments without the university's cloud services, The Tennessean reported. Student government leaders told the student newspaper, The Vanderbilt Hustler, that they were "frustrated by the university's lack of clear communication."

Vanderbilt Health said it is legally and financially separate from the university, that its IT systems had not been affected, and that patient care was continuing at all its hospital and clinical locations, WSMV reported.

Response and what is unknown

Vanderbilt University Information Technology is working with government agencies and other partners and will send updates throughout the week, the university said. It said its efforts to contain the incident had also limited its usual communications.

The university's IT team did not yet have a timeline for resolving the incident on the evening of November 9, The Vanderbilt Hustler reported. Vanderbilt has not said whether any data was taken.

Vanderbilt asked anyone who sees unusual activity, such as unexpected pop-ups, changed or deleted files in OneDrive or Box, or unexpected requests for passwords or sign-in approvals, not to click on links or prompts and not to troubleshoot the problem themselves. Instead, the university said, they should shut down the device and contact the IT service desk from a separate device or by phone.