Vanderbilt Cyberattack: Campus Told to Shut Down Devices, BYOD Ransomware Gang Claims Data Theft, and What Businesses Should Plan This Week
Vanderbilt University told students and staff to shut down university devices after a cyberattack on November 9, 2026. A group called BYOD claims it stole data. Vanderbilt has not confirmed that and says full recovery could take weeks.
Where United States · North America, United States & Canada
On this page 6 sections
On Monday, November 9, 2026, Vanderbilt University told students, faculty and staff to shut down university devices and get off campus Wi-Fi while its IT team contained an active cybersecurity incident. A ransomware group calling itself BYOD claims it stole personal and research data. Vanderbilt has not confirmed that, and it now says full recovery could take multiple weeks. Any business that runs on single sign-on, cloud email and shared files should take that timeline seriously.
Vanderbilt cyberattack: what happened
Vanderbilt posts updates on its own news site. Here is what it has said so far:
- 10:45 a.m., November 9: The university said it was responding to an active incident that may affect devices, systems and cloud-based services. It asked everyone to shut down university devices, disconnect from university Wi-Fi and watch for unexpected prompts, changed cloud files, or unexpected password or authentication requests. Anyone who saw those signs was told not to click anything or try to fix it themselves. Instead they should shut the device down and contact the IT Service Desk from a separate device or phone.
- 1 p.m., November 9: Classes continued on their normal schedule.
- 7:15 p.m., November 9: Campus Wi-Fi was back, but most systems stayed restricted. Vanderbilt said it was working with "government agencies and other partners" but did not name them.
- 9 a.m., November 10: Okta (multi-factor authentication still required), Outlook email on university and personal devices, Brightspace, Zoom and YES (with sophomore registration going ahead) were available again. People could use personal accounts such as Google as needed.
- 6 p.m., November 10: CampusPrint came back. Vanderbilt IT (VUIT) said it was "determining what data, if any, may have been accessed" and that full restoration could take "multiple weeks."
When we checked on Wednesday, November 11, the 6 p.m. November 10 update was still the most recent one posted.
Vanderbilt's FAQ adds more detail. Box, Oracle Cloud, Salesforce, PeopleSoft and Microsoft SharePoint, Teams and OneDrive are still switched off. Outlook was restored as a priority, but other Microsoft apps stay down because they depend on OneDrive, SharePoint and Teams. The FAQ says personal devices are not compromised and the impact appears limited to Vanderbilt-issued devices. The Record says Vanderbilt has about 14,000 students and more than 6,000 staff.
Vanderbilt ransomware: claimed vs confirmed
| Statement | Status |
|---|---|
| Vanderbilt has an active incident affecting devices, systems and cloud services | Confirmed by Vanderbilt |
| The BYOD group is behind it | Claimed. Ransomware.live, a site that tracks ransomware gangs' leak sites, shows BYOD listing "Vanderbilt EDU" on November 9. Vanderbilt has not named a group. |
| The group says Vanderbilt's databases are "locked" and it has "your entire estate and research data" | Claimed, in the group's listing text |
| More than 1 million Social Security numbers, student and employee records, and a "Full takeover" of the domain controller | Claimed in the group's message, as reported by Gizmodo. Not confirmed. |
| Personal, financial, health, student or research data was accessed | Not known. VUIT says it is still assessing. |
| Personal devices were compromised | Vanderbilt says no |
Vanderbilt calls this a cybersecurity incident. It has not confirmed ransomware, data theft or who is responsible. Attackers post on leak sites to pressure the victim, so treat their numbers as unproven until Vanderbilt or a regulatory filing confirms them. Ransomware.live also shows BYOD listing Michigan State University on November 2.
Why this matters for a business network
Three points apply to any company, not just universities.
Recovery takes weeks. Wi-Fi and email were back within a day, but Vanderbilt expects full restoration to take multiple weeks. Ask yourself which systems you would turn back on first, and what your staff would do while the rest stays off.
Everything depends on logins and shared files. Vanderbilt brought Okta and Outlook back early. SharePoint, Teams and OneDrive stayed off, and other Microsoft apps went down with them. If your quotes, accounting and customer files all sit in one cloud suite, one incident can stop all of them at once.
Confusion helps attackers. Vanderbilt told people that official alerts come only from info@vupublicsafety.com and to be careful with anything else. During an incident, staff expect strange password prompts and emails from "IT," so fake messages are easier to believe.
What to do this week: ransomware response checklist
| Action | How to check it is done |
|---|---|
| Write your "shut down and disconnect" message now | It is saved somewhere you can reach without company email, and you know who sends it |
| Pick one official channel for incident updates | Staff can tell you which address or number to trust |
| Set a restore order | You have a one-page list: logins and MFA, email, payments, customer-facing site, file shares |
| Map what depends on what | You know which apps stop working if your file-sharing service or login provider is switched off |
| Test an offline or immutable backup | You have restored a real file or server from it in the last 90 days |
| Lock down admin accounts | Few people have admin rights. Those accounts use MFA and are kept separate from everyday accounts. |
| Keep company and personal devices apart | Personal phones and laptops cannot reach servers or admin panels directly |
| Keep a phone list off the network | Numbers for IT, leadership, your insurer and outside counsel, on paper or a personal phone |
| If you work with Vanderbilt | Be suspicious of unexpected messages that claim to be from Vanderbilt IT, and check them against Vanderbilt's official news site |
If you host your own website or servers, the same restore order applies. Know how you would rebuild them from clean backups. Our self-hosting and infrastructure page explains that setup.
Vanderbilt cyberattack questions people are asking
Was Vanderbilt hit by ransomware?
A group called BYOD says so, and it listed the university on its leak site on November 9. Vanderbilt calls it an active cybersecurity incident and has not confirmed ransomware or named a group.
Was student data stolen in the Vanderbilt data breach?
That is not confirmed. The group claims to have Social Security numbers and student and employee records. Vanderbilt says VUIT is still working out what data, if any, was accessed.
Does BYOD mean the hackers got in through personal devices?
No. BYOD is the name the group uses. Vanderbilt says personal devices are not compromised and the impact appears limited to university-issued devices.
Is Vanderbilt University Medical Center affected?
Vanderbilt says Vanderbilt Health is legally and financially separate. It says Vanderbilt Health is taking precautions and monitoring the situation.
When will Vanderbilt systems be back?
Wi-Fi, Okta, Outlook, Brightspace, Zoom, YES and CampusPrint are already back. Vanderbilt says full restoration could take multiple weeks.
Should Vanderbilt students and staff reset their passwords?
Only if told to. The FAQ says VUIT will contact affected users directly. Official alerts come from info@vupublicsafety.com.
The bigger lesson
The ransom claim got the headlines. What will likely cost Vanderbilt the most is weeks of running with key systems switched off. A business that decides ahead of time what to shut down, who speaks for it and what comes back first will cope far better than one making those choices during the outage.
Get your network and website reviewed before an incident: see security hardening or request a quote.
Get security alerts like this by email, plus our free checklist, at security alerts.
Sources: Vanderbilt News: active cybersecurity incident updates; Vanderbilt cybersecurity incident FAQs; Ransomware.live: BYOD group; The Record; Gizmodo.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
SAP ICM2SHELL and PROXYGATE: Three CVSS 10.0 No-Login Flaws in the SAP Kernel and Gateway, a Fourth in SAML2, and the Patch Levels to Check
On November 10, 2026, SAP fixed three flaws found by Onapsis that let attackers with no login take over SAP sy...
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
