Vanderbilt University reports active cyber attack disrupting campus systems

On Monday, Nov. 9, 2026, Vanderbilt University announced an active cybersecurity incident, cautioning that the incident could affect devices, systems, and cloud-based services throughout the campus. The university serves about 14,000 students and employs more than 6,000 staff members. The university directed students, faculty, and staff to power off campus devices, disconnect from the Wi-Fi network, and remain alert. Vanderbilt’s technology team is working to investigate and contain the situation.

The ransomware cartel BYOD claimed credit for the breach, though Vanderbilt has not confirmed the attacker. BYOD asserted that it possessed more than 1 million Social Security numbers along with other personal data including names, e-mail addresses, phone numbers, and student and employee records, though independent verification is lacking. A third-party cyber attack tracking database also identified Vanderbilt as a BYOD victim and reported that hackers took student records and more than 1 million Social Security numbers belonging to the university. These claims remain unverified by the university or independent authorities.

Vanderbilt confirmed the attack around 11 a.m. Monday. By 7:15 p.m. Monday, campus Wi-Fi was back, but the majority of Vanderbilt systems and applications remained unavailable. Classes, student services, and staff reporting will operate on a normal schedule Tuesday, Nov. 10, 2026. Vanderbilt Information Technology plans to provide a further update by 9 a.m. on Tuesday covering the status of systems and applications.

The university has not given a timeline for restoring normal system access.

Ransomware incidents targeting schools, colleges, and universities rose 23% year over year in the first half of 2025, totalling 130 confirmed and unconfirmed incidents and averaging a ransom demand of $556,000. Halcyon documented a 40% increase in ransomware activity from July through September, involving 111 ransomware cartels responsible for 2,766 attacks on organizations in 122 countries. Trellix reported record numbers of ransomware cartel and victim posts from April to September, with new cartels accounting for a third of all posts during August.

Ransomware expert Allan Liska stated that BYOD has been expanding its activity recently and that its first known victim emerged on Sept. 29. BYOD is believed to have targeted Trump Mobile and subsequently leaked data on 3,615 prominent customers, drawing Congressional attention. The cartel recently took responsibility for intrusions at Michigan State University and the University of New Mexico Health System.

BYOD asserted that it exfiltrated data belonging to 1.3 million current and former Michigan State University students, while MSU stated that it is monitoring and investigating a potential cyber attack threat. The University of New Mexico incident disrupted medical facilities and forced a top-tier state hospital to reroute ambulances.

BleepingComputer reported that the University of New Mexico Health Sciences Center blocked new patient admissions, redirected ambulances, and suspended outpatient surgeries and appointments. BYOD reportedly issued an apology after its University of New Mexico attack disrupted patient systems and proposed financial compensation, and the university cautioned that the offer might be a scam.

In 2023, a ransomware cartel targeted Vanderbilt University Medical Center. The university listed these warning signs: unexpected pop-ups, security alerts, changes to files or cloud storage, unrecognized applications, and unsolicited requests for passwords or authentication approvals.

A faculty member said that Box cloud storage files were removed by administrators who claimed they had not accessed them, including accreditation information and admissions procedures. A Vanderbilt employee described seeing a system update prompt, followed by file deletion and a ransomware warning, after which their files gained a .byod extension. Accounts differ on whether the employee’s experience happened Monday morning or the previous Thursday.

One source reported that Vanderbilt’s employee IT help line had gone down, and employees said they received no guidance beyond the public statement. The Vanderbilt Hustler found that students became aware of the incident more than an hour and a half after faculty.

Vanderbilt Health stated that patient care is ongoing at all hospital and clinical locations, that the incident has not yet affected its systems, and that officials are closely monitoring the university situation. Vanderbilt Health and the university are legally and financially independent organizations.

Anyone who notices unusual activity should avoid clicking links, pop-ups, attachments, or prompts, should not attempt to troubleshoot, should power off the device immediately, and should contact the IT service desk using another device or by phone. The university shared these steps as it continues to investigate the scope of the incident and will provide further updates as information becomes available.