Vanderbilt University has confirmed it is responding to a cyberattack claimed by the BYOD ransomware gang, which alleges it encrypted the university's databases and stole sensitive student, employee, and research data.
The university issued a statement on Monday warning that university devices, systems, and cloud-based services may be affected. "We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services. Our Information Technology team is actively investigating and working to contain the situation," Vanderbilt University said in a post on X.
As part of its immediate response, the university directed students, faculty, and staff to shut down all university devices, disconnect from university Wi-Fi, and monitor for signs of compromise. Indicators listed by the institution include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage platforms, missing or modified files, unfamiliar applications, and unexpected authentication requests.
Those noticing suspicious activity were instructed not to investigate themselves but to power off devices immediately and contact the university's IT service desk. Vanderbilt University has not publicly disclosed whether systems were encrypted or whether data was stolen.
BYOD Ransomware Claims Responsibility
On Monday the BYOD ransomware group posted a claim on its data leak site alleging it had locked the university's databases and exfiltrated sensitive information. "If you could not tell already, your databases are locked. We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess," the post stated.
BleepingComputer received a photograph of an alleged compromised screen displaying Vanderbilt-associated icons and a ransom note named "README_BYOD_31.txt" that links to the BYOD leak site and provides contact details for the SESSION encrypted messaging platform. The note reads: "Oh no, you have been compromised by BYOD :< We have all of your data including your backups, your entire network is compromised. Yes, this affects your student and employee data the most, every single SSN is archived."
A video shared with BleepingComputer shows infected devices playing audio warnings that the network has been compromised by BYOD. While the ransom note and video strongly indicate BYOD involvement, Vanderbilt University has not officially confirmed the group's role or the encryption of devices.
BYOD is a relatively new ransomware operation that launched in 2026 and currently lists five other victim organizations on its leak site. Last month the group claimed an attack on the University of New Mexico Health Sciences Center that caused system outages and disrupted patient care and academic activities.
