SESSION

Vanderbilt University Hit in BYOD Ransomware Attack Claiming Encryption and Theft of Student Data

Vanderbilt University has confirmed an active cybersecurity incident involving the BYOD ransomware group, which claims to have encrypted university databases and stolen sensitive information belonging to students, employees, and research projects. The attackers allege possession of over one million Social Security numbers along with full names, email addresses, phone numbers, and complete student and employee records. In response, the university instructed all students, faculty, and staff to immediately power down devices, disconnect from university Wi-Fi, and report any suspicious activity such as unexpected pop-ups or modified files. Evidence shared with BleepingComputer includes a photograph of a ransom note displayed on a Vanderbilt computer and a video showing infected systems playing audio warnings about the compromise. BYOD, a ransomware operation that launched in 2026, previously claimed responsibility for an attack on the University of New Mexico Health Sciences Center that disrupted patient care. Vanderbilt has not yet confirmed encryption or data exfiltration publicly, though the group continues to threaten publication of stolen data unless negotiations begin via the SESSION encrypted messaging platform.