Vanderbilt University Ransomware Attack: What Is Confirmed, What the BYOD Gang Claims, and What Businesses Should Check This Week

On Monday, November 9, 2026, Vanderbilt University in Nashville told students and staff to shut down university devices and disconnect from campus Wi-Fi because of an active cybersecurity incident. A ransomware gang called BYOD has claimed the attack and says it stole data on more than a million people. Vanderbilt has not confirmed that claim. For any business, the useful part is this: when the network has to be switched off, a large part of the organization stops working, and getting it back can take weeks.

This post sets out what the university has confirmed, what the attackers claim, and what a business can check this week so it is ready for the same kind of day.

What happened at Vanderbilt University

Vanderbilt posts its own updates on the university news site. All times below are Central time, as the university gives them.

The university told people what warning signs to look for: unexpected pop-ups, unusual changes to cloud files or permissions, and password or login prompts they did not expect. Anyone who saw those signs was told not to click anything or try to fix it themselves, and to call the IT service desk from a separate device or phone.

The Vanderbilt Hustler, the student newspaper, adds more detail. It reports that VUIT confirmed a breach to the paper, that students saw pop-up "README" tabs on university devices, and that in a call on Monday evening the university said OneDrive and Box were still compromised and told users not to sign in to Microsoft services if prompted. The Hustler also reports that the FBI's Nashville field office said it is aware of the incident and helping. Vanderbilt's own updates do not use the word ransomware.

What the BYOD ransomware group claims

The attack became public when BYOD added Vanderbilt to its leak site. On that site the group claims to have:

• More than 1 million Social Security numbers, along with names, emails, phone numbers, and student and employee records
• Research data, and what it calls the university's entire estate
• Full control of the university's domain controller, the server that manages every account on a Windows network
• Locked the university's databases

None of this has been independently verified. Ransomware gangs inflate their claims to put pressure on victims. Until Vanderbilt finishes its investigation, the honest answer to "was data stolen?" is that nobody outside the attackers knows yet.

The Record reports that ransomware researcher Allan Liska puts BYOD's first known victim on September 29, 2026, and that the group has since claimed attacks on Michigan State University and the University of New Mexico. The New Mexico attack disrupted the school's medical facilities.

BYOD is a gang name, not a device policy

Many people search for this story expecting a "bring your own device" problem. In this case BYOD is the name the criminal group uses. Nothing in Vanderbilt's statements says personal phones or laptops were how the attackers got in. In fact, the university's November 10 update says Outlook works on personal devices and that personal accounts such as Google are safe to use. Separating personal devices from the network that reaches your servers is still a good idea, but it is not a lesson from what has been confirmed here.

Why this matters for a business network

Take away the campus and this looks like what happens to companies:

• The first instruction was "turn everything off." That only works if you can reach people when email and Wi-Fi are not trustworthy. Vanderbilt used its emergency alert system and a phone number for the service desk.
• Cloud files were part of the incident. The Hustler's report on OneDrive and Box is a reminder that synced cloud storage is not a backup. If an attacker controls an account, changes can sync everywhere.
• The identity system is the prize. Claims about a domain controller matter because whoever controls it can sign in as anyone. Okta came back early, with MFA still required.
• Recovery takes weeks. Vanderbilt was teaching again within a day, but says full recovery may take multiple weeks. A business that cannot invoice, ship or answer the phone for weeks feels that in cash.
• Communication is judged in real time. The Hustler reports student frustration over slow updates. Your customers and staff will judge you the same way.

If you already wonder who would pick up the phone on that day, our post on who you call when your systems go down covers that question.

Ransomware checklist: what to do this week

Vanderbilt ransomware attack questions people are asking

Was Vanderbilt hit by ransomware?

Vanderbilt has confirmed an active cybersecurity incident but has not called it ransomware in its updates. A ransomware group, BYOD, has claimed it, and students reported "README" pop-ups, which ransomware often leaves behind.

Who is the BYOD ransomware group?

It is a new criminal group. Researchers put its first known victim at the end of September 2026. It has also claimed attacks on Michigan State University and the University of New Mexico.

Was student and employee data stolen?

Not confirmed. BYOD claims more than a million Social Security numbers. As of its November 10 evening update, Vanderbilt said it was still working out what data, if any, was accessed.

How long will Vanderbilt take to recover?

The university says full restoration across all systems may take multiple weeks. Core services such as Wi-Fi, email, Okta and Brightspace were back on November 10.

What should Vanderbilt students and staff do?

Follow only official university updates, keep MFA on, treat any password or login prompt you did not expect as suspicious, and report anything odd to the IT Service Desk at 615-343-9999.

The bigger lesson

Ransomware is rarely only a technology problem. It is a test of whether you can switch things off, talk to your people and restore from a clean copy. Each of those can be checked and practiced before the bad day, not during it.

Want your network checked before someone else does it for you? See security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Vanderbilt University incident updates; The Vanderbilt Hustler; The Record.