Vanderbilt Cyber Attack: Why Students and Staff Were Told to Shut Down Devices

Vanderbilt University told students, faculty and employees to shut down university devices and disconnect from campus Wi-Fi on November 9 after identifying an active cybersecurity incident that could affect its computers, systems and cloud-based services.

The university’s warning followed reports of unusual computer notifications, unexpected changes to files and suspicious activity involving university accounts. Its IT team said it was investigating the incident and working to contain it.

The warning came as the ransomware group BYOD claimed responsibility for an attack on Vanderbilt, alleging that it had locked university databases and stolen sensitive information, including more than one million Social Security numbers. However, Vanderbilt has not confirmed the group’s involvement or whether any personal information was taken.

Vanderbilt’s initial announcement, published at 10:45 a.m. local time on Monday, asked the university community to shut down its devices, disconnect from university Wi-Fi and watch for unusual activity.

The instructions were a precaution intended to reduce the risk of further security problems while the university investigated. Vanderbilt did not publicly explain the precise technical reason for the shutdown or identify how the attackers may have gained access.

It warned people to look out for unexpected pop-ups, security notifications, unfamiliar applications, unusual password requests and changes to files or permissions in cloud storage services such as Microsoft OneDrive and Box.

Anyone who noticed suspicious activity was told not to click unfamiliar links, attachments or prompts, or attempt to investigate and fix the problem themselves. Instead, Vanderbilt instructed them to shut down the affected device immediately and contact its IT service desk using a separate device or telephone.

The university’s warning was not limited to ransomware messages. Missing files, unexpected changes to documents and unfamiliar authentication requests were also listed as possible signs of suspicious activity.

Reports from people on campus provide a clearer picture of how the incident affected everyday university work.

The Nashville Banner reported that one Vanderbilt employee encountered an unexpected notification saying the computer was running a system update after starting it on Monday morning. Another notification reportedly said it was deleting old files. A ransomware warning then appeared, and the employee said the files on the computer had changed to names ending in “.byod”.

The extension is the part of a filename that appears after its final dot. For example, a document named report.docx might be renamed report.byod. Attackers can use new file extensions during ransomware incidents, although a changed filename alone does not prove that its contents were encrypted or stolen.

Another faculty member told the Banner that employees had received notifications suggesting files in Box had been deleted by administrators. According to the faculty member, the administrators had not accessed those files. The missing material reportedly included accreditation information and admissions procedures.

These accounts raise concerns about access to university work and research, but they do not establish that every Box account or cloud-based service was compromised.

The Banner also reported that an anonymous source, who was not authorised to speak publicly, said Vanderbilt’s employee IT help line “had crashed”. Other employees told the publication they had received little guidance beyond the university’s public announcement.

The Vanderbilt Hustler, the university’s student newspaper, separately reported that students were notified about the incident more than an hour and a half after faculty members.

WPLN News also spoke to Vanderbilt student Aminat Rosenje, who described learning about the situation during a class when an IT employee entered and instructed people to disconnect from Wi-Fi and avoid opening emails or clicking links.

The disruption extended beyond individual computers. Vanderbilt’s Writing Studio and Tutoring Services cancelled appointments and closed for the afternoon and evening of November 9 after receiving instructions to shut down their computers.

Despite these problems, the university said classes would continue as scheduled. Its 1 p.m. update confirmed that classes were proceeding normally.

In a further statement at 7:15 p.m., Vanderbilt said campus Wi-Fi was available again, but access to most university systems and applications remained restricted. It acknowledged that the incident had disrupted important work and caused frustration across the university.

The university also said it was working with government agencies and other partners to manage the situation. Classes, student services and normal staff operations were scheduled to continue on Tuesday, November 10. Vanderbilt promised another update by 9 a.m. Tuesday covering the availability of its systems and applications.

Meanwhile, BYOD’s claims have raised questions about the possible exposure of student, employee and research information.

The ransomware group listed Vanderbilt on its data leak website and claimed it had obtained university research data, student and employee records, names, email addresses, phone numbers and more than one million Social Security numbers.

It also claimed that it had taken control of a Domain Controller, a central system used by Windows networks to manage user accounts and access permissions.

BleepingComputer reported receiving a photograph of an alleged Vanderbilt computer displaying a ransom note named README_BYOD_31.txt. The note included a link to the ransomware group’s website and threatened to release information if the university did not negotiate.

BleepingComputer confirmed that the link in the note led to a website operated by BYOD. This provides a connection between the displayed ransom note and the group, but it does not independently establish the extent of the university’s network compromise or authenticate the stolen-data claims.

The group has not provided independently verified evidence establishing that it obtained more than one million Social Security numbers. It is also unclear whether its claimed figure represents individual people, duplicate records, older information or a mixture of different records.

Vanderbilt has not confirmed that BYOD carried out the incident, that its databases were encrypted or that personal information was stolen. There is currently no verified figure for the number of people whose information may have been exposed.

There is also an important distinction between Vanderbilt University and Vanderbilt Health.

In a separate November 9 announcement, Vanderbilt Health told employees not to access the university’s IT resources or connect removable media, including USB drives and external storage devices, to university systems.

The health organisation said its own IT systems had not been affected at the time of its statement and that patient care was continuing at all its hospitals and clinical locations.

Consequently, there is no established evidence that patient records were stolen or that hospital services were disrupted by this university incident.

For Vanderbilt students and employees, the university’s instructions remain the most important guidance. Anyone who sees unexpected warnings, unfamiliar applications, missing files or unusual authentication requests on a university device should not click unfamiliar prompts or attempt their own recovery. They should shut down the affected device and contact the university’s IT service desk from a separate device or telephone.

People should also be alert to emails, text messages and phone calls claiming to offer help with the incident. Criminals may use a widely reported cyberattack to send fake security updates, impersonate university IT staff or ask people for passwords and authentication codes.

Anyone who later receives an official notification that their personal information was exposed should follow the university’s instructions. Depending on what information was involved, monitoring financial accounts or placing a credit freeze may be appropriate. However, the current evidence does not establish that every student or employee has had their Social Security number or other personal information stolen.

The most important unanswered questions concern how the attackers gained access, which university systems were affected, whether data was actually taken and how long it will take to restore normal access.

For now, Vanderbilt has confirmed an active cybersecurity incident, unusual activity warnings and restrictions on access to many university systems. BYOD’s claims of a complete network takeover and the theft of more than one million Social Security numbers remain unverified.

That distinction is important: the disruption at Vanderbilt is real, but the full extent of the alleged data theft has not been established.