Vanderbilt University tells students and staff to shut down devices after a ransomware gang claims an attack
The BYOD gang says it encrypted university databases and stole student, employee and research data. Vanderbilt has not confirmed any data theft.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Vanderbilt University said Monday it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services. The announcement came after the BYOD ransomware gang added the Nashville school to its leak site. The gang claims it encrypted the university's databases and stole sensitive student, employee and research data. Vanderbilt has not disclosed the nature of the attack or confirmed whether any data was stolen. Its IT team is investigating and working to contain the incident. The university told students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and stay alert. Warning signs it listed include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage, missing or modified files, unfamiliar applications, and unexpected authentication requests. People who notice them should shut down their devices and contact the IT service desk instead of troubleshooting themselves. Vanderbilt has about 14,000 students and more than 6,000 staff. Vanderbilt University Medical Center was hit by a separate ransomware attack in 2023. In recent weeks, BYOD has also claimed attacks on Michigan State University and the University of New Mexico, where the attack also affected the school's medical facilities.