Vanderbilt Ransomware Attack: What Students Must Do & Who Is at Risk
Vanderbilt University is restoring campus systems after a ransomware attack on November 9, as a gang claims it stole over one million Social Security numbers.
Image: Wikimedia Commons / PCN02WPS
NASHVILLE, Nov. 10, 2026 — Vanderbilt told students and staff to shut down devices and disconnect from campus Wi-Fi on Monday after disclosing an active cybersecurity incident. A ransomware group calling itself BYOD claims it locked the university's databases and stole sensitive personal data. The university said the incident, disclosed at 10:45 a.m. Central time on Nov. 9, may affect devices and cloud services. The university has not confirmed BYOD was responsible or data was stolen.
By Tuesday morning, Wi-Fi, email and core systems were back online. The university said staff and students could resume using devices from 9 a.m. on Nov. 10, with Okta, Outlook, Brightspace, Zoom and enrollment services restored. All other systems remain restricted, including CampusPrint, and classes are proceeding normally.
Key Takeaways
- Vanderbilt disclosed an active cybersecurity incident at 10:45 a.m. Central time on Nov. 9 and told campus to shut down devices.
- BYOD claims it stole over one million Social Security numbers from Vanderbilt. Vanderbilt has not confirmed the claim.
- By 9 a.m. Tuesday, Wi-Fi, Okta, Outlook, Brightspace, Zoom and enrollment services were back. Other systems, including CampusPrint, remain restricted.
- Vanderbilt Health said its systems were unaffected and patient care is continuing.
Vanderbilt Cyberattack: What Happened and What BYOD Claims
The disruption began on Monday morning, when Vanderbilt IT staff entered classrooms to warn faculty that school-issued computers were unsafe. Hours later, BYOD claimed responsibility on its data leak site, saying it had locked the university's databases and taken student, employee and research data, including more than one million Social Security numbers.
Vanderbilt has not confirmed any of that. The university has not said whether BYOD was responsible, and its information technology team is working with government agencies and other partners. BYOD is a new ransomware group, active since late September 2026.
| Date and time | What happened |
|---|---|
| Mon, Nov. 9, 10:45 a.m. CST | Vanderbilt discloses the incident; campus told to shut down devices |
| Mon, Nov. 9, afternoon | BYOD claims it locked databases and stole over one million Social Security numbers |
| Mon, Nov. 9, 7:15 p.m. CST | Campus Wi-Fi restored; most systems remain restricted |
| Tue, Nov. 10, 9 a.m. CST | Devices back in use; Okta, Outlook, Brightspace, Zoom, enrollment services restored |
Vanderbilt Systems Restored and Still Down After the Attack
The university's Tuesday update listed the systems available: campus Wi-Fi, Okta with multi-factor authentication, Vanderbilt email through Outlook, Brightspace, Zoom and YES enrollment services. Classes are running normally.
Everything else remains restricted. The university said all other systems remain unavailable, including CampusPrint, with no timeline given for full restoration. Vanderbilt Health said its IT systems were unaffected. The incident follows a breach at AI firm Fireworks that exposed customer data, and a cyberattack on French supermarket refrigeration systems attributed to an Iranian military unit.
What Vanderbilt Students and Staff Should Do
Anyone who powers on a university device and sees abnormal activity should contact the IT Service Desk at 615-343-9999. The university's warning listed signs to watch for: unexpected pop-ups, strange file edits, missing files, unfamiliar apps and unexpected logins.
Students and staff should keep multi-factor authentication on for Okta, and change their Vanderbilt password if prompted. Anyone who used a university device on Monday should check for changes they did not make. Until Vanderbilt confirms the scope, those whose records may be involved should treat the Social Security numbers in the BYOD claim as potentially exposed.
Frequently Asked Questions
Is my Social Security number at risk in the Vanderbilt cyberattack?
BYOD claims it stole more than one million Social Security numbers, but Vanderbilt has not confirmed any data was taken. Students and staff should watch for identity theft and report suspicious activity to the IT Service Desk.
Can Vanderbilt students use campus Wi-Fi and email now?
Yes. Wi-Fi returned Monday evening, and by 9 a.m. Tuesday devices were back in use. Okta, Outlook, Brightspace, Zoom and enrollment services are available; other systems remain restricted.
Who is the BYOD ransomware group behind the Vanderbilt attack?
BYOD is a ransomware group active since late September 2026. It claims it stole student, employee and research data, but Vanderbilt has not confirmed BYOD was responsible.
Will Vanderbilt classes and registration continue as scheduled?
Yes. Vanderbilt said Tuesday, Nov. 10, would run on a normal schedule, with classes proceeding and student services open. Sophomore registration is proceeding as scheduled.
Vanderbilt has not yet said when the remaining systems will be restored or whether data was stolen. The university said it will keep sending updates through the week.
