Vanderbilt University in Nashville, Tennessee, is investigating a cyberattack that prompted emergency warnings to students and employees and raised concerns about the security of university records. The ransomware group BYOD has claimed responsibility, alleging that it encrypted databases and obtained sensitive personal and research information.
The university confirmed the cybersecurity incident on November 9, 2026, warning that campus computers, internal systems, and cloud-based services could be affected. Its information technology team began investigating the intrusion and working to contain the threat.
As a precaution, Vanderbilt instructed students, faculty, and staff to shut down university-issued devices and disconnect from campus Wi-Fi. The university also warned users about unexpected security notifications, unfamiliar applications, suspicious authentication requests, and unexplained changes to files or cloud storage permissions.
Reports from the campus newspaper, The Vanderbilt Hustler, indicated that some university computers displayed ransom-related messages. Students and employees also reported disruptions involving files and applications, while IT personnel visited classrooms to alert users about the situation.
BYOD subsequently listed Vanderbilt on its data leak website, claiming to have compromised the university’s network and encrypted its databases. The attackers alleged that they had obtained research materials, student and employee records, and more than one million Social Security numbers, along with names, email addresses, and telephone numbers.
These claims have not been independently verified. Vanderbilt has not confirmed that the attackers stole personal information, successfully encrypted its databases, or obtained the volume of records described in the group’s statement.
BleepingComputer reported receiving a photograph of a computer displaying a ransom note associated with BYOD. The message included instructions for contacting the attackers through the Session encrypted messaging platform and threatened to release stolen information if the university refused to negotiate.
A separate video reportedly showed compromised computers playing an audio message announcing the intrusion. Although these materials support the possibility of ransomware activity, the university has not officially attributed the attack to BYOD.
The group emerged in 2026 and has claimed attacks against several organizations. Its previous allegations include an October incident involving the University of New Mexico Health Sciences Center, where a cyberattack disrupted healthcare and academic operations.
Vanderbilt serves approximately 14,000 students and employs thousands of faculty and staff members. Despite the cybersecurity incident, university representatives told Axios that classes were continuing as scheduled.