VULNpocalypse
LowBreach / campaignMonitoring

BYOD ransomware group claims attack on Vanderbilt University

BYOD ransomware group claims it encrypted Vanderbilt University and stole data; the university has not confirmed. Follow official IT guidance.

Published
Updated
Exploitation
Not confirmed. The sources name no vulnerability or entry point, and the ransomware group’s claims are unverified.

What happened

According to BleepingComputer, the BYOD ransomware group claims it encrypted Vanderbilt University’s databases and stole sensitive student, employee and research data. The group posted this on its data leak site on Monday, November 9. The claim is not proof, and Vanderbilt has not confirmed it.

What Vanderbilt itself has said:

  • It disclosed an “active cybersecurity incident” that may affect university devices, systems and cloud-based services, according to BleepingComputer. Infosecurity Magazine reports the first notice came at 10.45am CST on November 9.
  • It told the university community to shut down university devices, disconnect from university Wi-Fi and watch for suspicious activity, per Infosecurity Magazine.
  • A later update at 7.15pm CST said classes and student services would run normally from November 10 and campus Wi-Fi was available. Access to most systems and applications remained restricted, and Vanderbilt IT was working with government agencies and other partners, according to Infosecurity Magazine.

What BYOD claims, according to BleepingComputer, The Register and Gizmodo:

  • The group’s leak-site post says it holds “Over 1 Million SSNs”, full names, email addresses, phone numbers, student and employee records, research data and a “full takeover” of the domain controller.

Evidence reported by the outlets:

  • BleepingComputer says it received a photograph of an alleged computer screen showing a BYOD ransom note named “README_BYOD_31.txt”. It says the link in the note points to the site operated by BYOD.
  • BleepingComputer says a video shared with it shows infected devices playing audio saying the network had been compromised by “BYOD”. The Register reports that campus computers reportedly played an audio threat attributed to BYOD, and cites The Vanderbilt Hustler, which in turn cited posts on the campus social network Fizz.
  • Gizmodo says students using university-issued devices reported their desktops suddenly filling with copies of the attackers’ readme file, as well as popups. It also cites Nashville Scene reporting that one person’s files were rewritten into a “.byod” format and that another person’s research hosted on university systems was inaccessible.

What is not confirmed:

  • Vanderbilt has not publicly confirmed BYOD’s involvement, whether systems were encrypted, or whether any data was stolen (BleepingComputer, The Register).
  • The sources do not say how the attackers got in. The data volume and the “over 1 million” figure are BYOD’s claim only.

The Register also reports that BYOD claimed an attack on Texas Health and Human Services on the same Monday. That agency has not publicly confirmed an incident.

The Washington Post, DataBreaches.net and CyberScoop also covered the story. Only their headlines were available to us, so we cite them for nothing beyond those headlines, for example that The Washington Post’s headline says Vanderbilt shut down devices after a cyber attack.

Am I affected?

  • If you are a Vanderbilt student, faculty or staff member, or use university devices, systems or cloud services, the university says they may be affected. Which data, if any, was taken is not confirmed.
  • Whether personal data about you was stolen is not confirmed by Vanderbilt. BYOD’s list of data types is an unverified claim.
  • If you have no connection to Vanderbilt, the sources give no indication that you are affected.

What to do now

  1. Follow the instructions Vanderbilt publishes on its website and official channels. They are the authoritative source and are being updated.
  2. If you use a university device, follow the university’s guidance on shutting devices down and on Wi-Fi. Do not assume a device is safe because campus Wi-Fi is back, since access to most systems is still restricted.
  3. Watch for the signs Vanderbilt lists, per Infosecurity Magazine and BleepingComputer:
    • unexpected pop-ups or security notifications
    • unusual changes to files, folders or permissions in cloud storage
    • missing or modified files
    • unfamiliar applications
    • unexpected password or authentication requests
  4. If you see any of these, do not investigate or troubleshoot it yourself. Shut the device down and contact the university’s IT service desk, as the university instructs.
  5. Treat BYOD’s data claims as unverified until Vanderbilt says otherwise. This advisory will need updating if the university confirms or denies data theft.

Update, 11 November 2026

  • RansomLook’s BYOD leak-site listing shows the group also posted claims against the University of New Mexico on 2026-10-26 (36,000 machines, student and employee PII including SSNs) and Michigan State University on 2026-11-02 (PII for 1.03 million current and former students), so Vanderbilt is not its first university target. (ransomlook.io)
  • RansomLook’s copy of BYOD’s Texas HHSC post claims data on 2 million Texas citizens (Medicaid, banking information, SNAP, TANF, disaster assistance), posted 2026-11-09. This is an unverified group claim. (ransomlook.io)
  • RansomLook records 20 BYOD posts in total, 12 of them in the last 30 days, with the most recent on 2026-11-10 03:25. (ransomlook.io)

Sources