Vanderbilt University Battles Ransomware Attack on Campus Network
Campus Wi-Fi is restored, but key systems remain restricted after hackers claim to have stolen personal records and locked databases.
- By Jesse Jacobs
- November 10, 2026
An active cybersecurity incident has compromised university devices, systems and cloud-based services at Vanderbilt University, forcing widespread technology shutdowns across the campus.
Vanderbilt Information Technology asked all campus community members to shut down university-issued devices, disconnect from the network and monitor equipment for unauthorized changes or suspicious authentication prompts. While campus Wi-Fi was restored following an initial blackout, access to most internal systems and applications remains restricted.
University leadership confirmed that academic operations and student support services are continuing on a normal schedule, with instructors directed to provide flexibility regarding coursework deadlines. Technicians are working alongside government agencies and external partners to manage and contain the disruption.
According to a report by Cybernews, the disruption is tied to an extortion campaign orchestrated by the BYOD ransomware gang. On its leak website, the cyber syndicate claimed to have encrypted university databases, locked research data and achieved a full takeover of domain controllers.
The group alleged that it exfiltrated sensitive files containing more than one million Social Security numbers, full names, email addresses, phone numbers and employee and student records. The outlet identified BYOD as an emerging ransomware operation active since late September, known for targeting higher education and healthcare entities.
Operational details and on-the-ground campus impacts were detailed by the student newspaper, The Vanderbilt Hustler. According to the publication, faculty were alerted more than an hour before students, and university-issued computers displayed dozens of pop-up "README" notes and broadcast audible breach alerts live during lectures, leading some instructors to cancel classes.
The student paper further reported that while platforms such as Brightspace and YES were deemed safe to use late Monday, November 9, cloud storage platforms OneDrive and Box remained compromised.