Vanderbilt University responds to cyberattack as BYOD ransomware group claims data theft
Staff and students are being told to shut down devices and avoid campus Wi-Fi while the university has yet to confirm what was taken.
Vanderbilt University says it is handling an active cybersecurity incident that could reach university devices, systems and cloud services, and has told staff and students to power down devices, leave the campus Wi-Fi and report anything odd to the IT service desk. The university has not described the attack or said whether data was taken. The BYOD ransomware group, a newcomer that began operating in 2026, has posted a claim on its leak site asserting that it encrypted Vanderbilt's databases and took records including large numbers of Social Security numbers, names, contact details and research material. A ransom note seen by BleepingComputer also names BYOD, though the university has not confirmed the group's involvement or the extent of any encryption. The same group previously claimed an attack on the University of New Mexico Health Sciences Center last month.
Why it matters
Vanderbilt has not confirmed that data was stolen, so the scale of any exposure remains unknown for now. The claims come from a group that only began operating in 2026 and that has also claimed an earlier attack on a New Mexico health sciences center. For people whose records may be involved, the key open question is whether the university confirms the theft and what it says about affected data. Readers should treat the group's stated figures as unverified claims until the university provides details.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.