Vanderbilt University has issued a warning regarding its response to a cyberattack attributed to the BYOD ransomware group, which asserts that it has encrypted the university’s databases and stolen sensitive information related to students, employees, and research.
The university confirmed the occurrence of this incident on Monday, indicating that university devices, systems, and cloud services might be compromised.
In a statement posted on X, Vanderbilt stated, “We are currently addressing an active cybersecurity incident that may affect university devices, systems, and cloud-based services. Our Information Technology team is diligently investigating and working to manage the situation.”
As part of their response, the university advised students, faculty, and staff to power down university devices, disconnect from the university Wi-Fi, and remain vigilant for any suspicious activities.
The university cautioned that indicators of a breach could include unexpected pop-ups or security alerts, unusual alterations to files or permissions in cloud storage, missing or altered files, unfamiliar applications, and unexpected authentication prompts.
Individuals who observe any suspicious activity were advised not to attempt to investigate or resolve the issue on their own, but rather to immediately shut down their devices and reach out to the university’s IT service desk.
Vanderbilt has not publicly revealed the specifics of the attack or confirmed whether any data has been compromised.
BleepingComputer reached out to Vanderbilt University with inquiries regarding the attack, including whether systems were encrypted, what data might have been taken, and if the incident has been contained.
If you possess any information about this incident or other undisclosed attacks, you can confidentially contact us via Signal at 646-961-3731 or at tips@bleepingcomputer.com.
BYOD ransomware claims responsibility for the attack
On Monday, the BYOD ransomware group took responsibility for the attack on its data leak site, claiming to have encrypted Vanderbilt’s databases and stolen sensitive information belonging to students and employees.
The BYOD data leak site states, “If you could not tell already, your databases are locked. We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess.”
BleepingComputer has received a photograph purportedly showing a computer screen with icons linked to Vanderbilt University, along with a BYOD ransom note titled “README_BYOD_31.txt.”
This ransom note contains a link to the BYOD data leak site and provides contact details for the SESSION encrypted messaging platform for negotiations with the ransomware group. BleepingComputer has verified that the link in the ransom note directs to the site operated by BYOD.
The ransom note states, “Oh no, you have been compromised by BYOD :<. We have all of your data including your backups; your entire network is compromised."
It continues, “Yes, this affects your student and employee data the most; every single SSN is archived, full names, email addresses, phone numbers, work addresses, roles, birthdays, quite literally everything.”
The note also threatens to release stolen data and cause further disruption if the university does not engage in negotiations with the attackers.
A video shared on YouTube and with BleepingComputer demonstrates how infected devices are playing audio warnings indicating that the network has been compromised by “BYOD.” While the ransom note and video suggest BYOD is responsible for the attack, Vanderbilt has not officially confirmed the group’s involvement or whether devices were encrypted.
BYOD is a relatively new ransomware group that emerged in 2026 and currently lists five other organizations on its data leak site. Last month, the ransomware group claimed responsibility for an attack on the University of New Mexico Health Sciences Center, which resulted in system outages and disrupted patient care and academic activities.
Uncover email threats your existing defenses may miss. Adaptive Security’s AI agents analyze e
Source: Original article
