Vanderbilt University responds to active cybersecurity incident, tells campus to shut down university devices and disconnect from WiFi

1. Nov 10, 2026, 1:19 AM
   Vanderbilt posts active cybersecurity incident notice asking community to shut down devices and disconnect from WiFi^[1]
2. Nov 10, 2026, 2:30 AM
   The Record reports BYOD listed the university on its leak site^[2]
3. Nov 10, 2026, 8:15 AM
   BYOD ransomware gang claims attack, alleging encrypted databases and stolen student and employee data^[3]

   BleepingComputer reports that the BYOD ransomware gang claimed the attack on Vanderbilt University on its data leak site on Nov 9 (US time), alleging it encrypted the university's databases and stole sensitive student and employee data, including over 1 million SSNs, names, emails, phone numbers and student and employee records. BleepingComputer obtained a photo of an alleged university computer displaying a BYOD ransom note named README_BYOD_31.txt and confirmed the note's link points to BYOD's site. Vanderbilt has not officially confirmed BYOD's involvement, whether devices were encrypted, or whether data was stolen; the data claims are the attackers' and unverified.

Vendor guidance

1. 1
   Shut down devices and disconnect WiFi mitigate^[1]

   Shut down university devices and disconnect from university WiFi as instructed.

2. 2
   Watch for suspicious activity detect^[1]

   Watch for unexpected pop-ups, cloud file or permission changes and unexpected authentication requests; shut down and report to the IT service desk.