Vanderbilt University is responding to a cyberattack claimed by the relatively new BYOD ransomware gang, which says it encrypted the university's databases and stole sensitive data including Social Security numbers, student records and research data. The university confirmed the incident Monday but has not publicly confirmed the group's involvement or whether any data was stolen.
“We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services,” Vanderbilt said in a statement posted on X. “Our Information Technology team is actively investigating and working to contain the situation.” The university instructed students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for signs of compromise such as unusual file changes or unexpected authentication requests.
The BYOD ransomware group took responsibility on its data-leak site Monday, posting a message claiming it had encrypted Vanderbilt's databases and stolen “Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess.” The message said the attackers possess “your entire estate and research data.”
BleepingComputer obtained a photograph of an alleged computer screen showing icons associated with Vanderbilt University and a ransom note named “README_BYOD_31.txt.” The note included a link to the BYOD leak site and contact details for the SESSION encrypted messaging platform. The note read: “We have all of your data including your backups, your entire network is compromised.” A video shared with the outlet showed infected devices playing an audio warning that the network had been compromised by “BYOD.”
BYOD is a relatively new ransomware operation that launched in 2026 and lists five other organisations on its leak site. Last month, it claimed an attack on the University of New Mexico Health Sciences Center that caused system outages and disrupted patient care and academic activities.
Analysis
Why This Matters
- The breach could expose the personal data of more than 1 million individuals, including current and former students and employees.
- The targeting of a major research university risks theft of sensitive intellectual property and disruption to ongoing research.
- The incident signals the growing activity of a new ransomware gang that has now hit two US universities within a month.
Background
BYOD is a ransomware group that first appeared in 2026 and operates a data-leak site listing victims whose data it claims to have stolen. Its attack on the University of New Mexico Health Sciences Center in October 2026 led to system outages that affected patient care and academic work. The group uses a double-extortion model, encrypting systems and threatening to release stolen data.
Key Perspectives
- Vanderbilt University: Says it is responding to an active cybersecurity incident that may affect devices, systems and cloud-based services; has not confirmed BYOD's involvement or any data theft.
- BYOD ransomware group: Claims it encrypted Vanderbilt's databases and stole over 1 million Social Security numbers, student and employee records, and research data; threatens to release the data if a ransom is not paid.
What to Watch
- Whether Vanderbilt confirms the breach's scope and whether sensitive data was exfiltrated.
- If the university negotiates with the group and whether stolen data appears on the leak site.
- The operational impact on Vanderbilt’s classes, research, and clinical services.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe BYOD ransomware gang says it stole more than 1 million Vanderbilt Social Security numbers.BleepingComputer: “"Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess," reads the BYOD data leak site.”
- SupportedVanderbilt acknowledged an active cybersecurity incident.BleepingComputer: “"We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services.”
- SupportedVanderbilt urged users to shut down university devices.BleepingComputer: “As part of its response, the university told students, faculty, and staff to shut down university devices, disconnect from university Wi-Fi, and watch for suspicious activity.”
- SupportedVanderbilt is responding to a cyberattack claimed by the BYOD ransomware gang.BleepingComputer: “Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang”
- SupportedBYOD claims it encrypted Vanderbilt's databases and stole sensitive data, including student, employee, and research data.BleepingComputer: “Vanderbilt University hit in BYOD ransomware attack, data theft claimed. Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data.”
- SupportedVanderbilt confirmed the incident Monday.BleepingComputer: “The university confirmed the incident Monday, warning that university devices, systems, and cloud-based services may be affected.”
- SupportedVanderbilt has not publicly confirmed BYOD's involvement or whether data was stolen.BleepingComputer: “While the ransom note and video indicate BYOD is behind the attack, Vanderbilt has not officially confirmed the group's involvement or whether devices were encrypted.”
- SupportedVanderbilt said it was investigating and working to contain the incident.BleepingComputer: “"Our Information Technology team is actively investigating and working to contain the situation," Vanderbilt said in a statement on X .”
- SupportedVanderbilt told students, faculty, and staff to disconnect from university Wi-Fi and watch for signs of compromise, including unusual file changes and unexpected authentication requests.BleepingComputer: “As part of its response, the university told students, faculty, and staff to shut down university devices, disconnect from university Wi-Fi, and watch for suspicious activity. The university warned that signs of compromise may include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage platforms, missing or modified files, unfamiliar applications, and unexpected authentication requests.”
- SupportedBYOD claimed responsibility on its data-leak site Monday and posted a claim about more than 1 million SSNs and other information.BleepingComputer: “On Monday, the BYOD ransomware group claimed responsibility for the attack on its data leak site, alleging that it had encrypted Vanderbilt's databases and stolen sensitive information belonging to students and employees. "If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess," reads the BYOD data leak site.”
- SupportedBleepingComputer received a photograph of an alleged computer screen showing Vanderbilt-associated icons and a ransom note named “README_BYOD_31.txt”; the note included a link to the leak site and SESSION contact information.BleepingComputer: “BleepingComputer has since received a photograph of an alleged computer screen showing icons associated with Vanderbilt University and displaying a BYOD ransom note named "README_BYOD_31.txt". The ransom note includes a link to the BYOD data leak site and contact information for the SESSION encrypted messaging platform to negotiate with the ransomware gang.”
- SupportedThe ransom note said, “We have all of your data including your backups, your entire network is compromised.”BleepingComputer: “"We have all of your data including your backups, your entire network is compromised."”
