Vanderbilt University has confirmed it is responding to an active cybersecurity incident that may affect university devices, systems, and cloud-based services. The university’s Information Technology team is investigating and working to contain the situation. Vanderbilt has not publicly disclosed the nature of the attack or confirmed whether any data was stolen.

The BYOD ransomware group has claimed responsibility on its data leak site. The group alleges it encrypted Vanderbilt’s databases and stole sensitive information, including what it describes as over one million Social Security numbers along with names, email addresses, phone numbers, and student and employee records. The group also claims it has access to backups and research data. BleepingComputer has reviewed a photograph of an alleged ransom note named “README_BYOD_31.txt” displayed on a university-branded computer, along with a video in which infected devices play audio stating the network was compromised by BYOD. The note directs the university to the group’s leak site and to an encrypted messaging contact for negotiations. These materials suggest BYOD is behind the attack, but Vanderbilt has not officially confirmed the group’s involvement or whether devices were encrypted.

Guidance issued to the community

The university has instructed students, faculty, and staff to shut down university devices, disconnect from university Wi-Fi, and watch for signs of compromise. Indicators listed include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage, missing or modified files, unfamiliar applications, and unexpected authentication requests. Users who observe suspicious activity were told not to troubleshoot on their own and to contact the IT service desk immediately.

About the BYOD group

  • BYOD is a relatively new ransomware operation that emerged in 2026.
  • Its leak site lists five other organizations.
  • Last month, the group claimed an attack on the University of New Mexico Health Sciences Center, an incident that reportedly caused system outages and disrupted patient care and academic activities.

For security teams, the case underscores the importance of rapid device isolation, cloud storage monitoring, and tested incident response procedures in higher education environments that hold large volumes of personal and research data. Affected individuals may wish to monitor for identity misuse while the university’s investigation continues.