Vanderbilt Ransomware Attack Hits Nashville Campus as Gang Claims 1M SSNs Stolen

Vanderbilt University in Nashville, Tennessee, confirmed on Monday, November 9, 2026, that it is responding to an active cybersecurity incident that may have affected university devices, systems and cloud-based services, after a ransomware gang calling itself BYOD claimed to have locked the university's databases and stolen more than one million Social Security numbers. The university told students, faculty and staff to shut down university-issued devices and disconnect from campus Wi-Fi. Vanderbilt has not confirmed the gang's claims or said whether any data was stolen.

Key Points

• Vanderbilt University confirmed on Monday, November 9, 2026, that it is responding to an active cybersecurity incident affecting its devices, systems and cloud services.
• The BYOD ransomware gang claimed responsibility on its data leak site, saying it locked Vanderbilt's databases and stole over one million Social Security numbers.
• The breach was found at 9:50 a.m. CST, but the campus was not notified until 11:26 a.m. CST.
• Vanderbilt has not confirmed the gang's claims or whether any data was stolen.
• By 7 p.m., campus Wi-Fi was restored but most systems stayed restricted, and Tuesday classes were set to run normally.

What Happened

The breach was discovered at 9:50 a.m. CST on Monday, but the campus was not told until 11:26 a.m., almost 96 minutes later. Pop-up tabs carrying the gang's message appeared on university-issued computers, and a video online showed infected devices playing an audio warning that the network had been compromised by "BYOD". Staff entered classrooms to warn lecturers not to use school-issued devices, after the IT team confirmed a breach to the student newspaper, The Vanderbilt Hustler.

Vanderbilt told the whole campus to shut down university devices, disconnect from campus Wi-Fi and watch for suspicious activity, including unexpected pop-ups, changed files, unfamiliar applications and unexpected login requests. Anyone who noticed a problem was told not to investigate it, but to shut the device down and contact the IT service desk. By 7 p.m., campus Wi-Fi was restored, but most systems stayed restricted, and Tuesday classes ran normally.

Background: A New Gang Targeting Universities

BYOD is a new ransomware gang that emerged in September 2026, and Vanderbilt is its latest high-profile target. The group lists five other organisations on its data leak site, and has also claimed attacks on Michigan State University and the University of New Mexico Health and Sciences Center. Last month, its attack on the New Mexico centre caused system outages and disrupted patient care and academic work.

It fits a wider trend: ransomware groups target universities and hospitals, which hold sensitive data and research and cannot easily shut down. The Vanderbilt incident follows the Marathon Health breach, which reportedly exposed the medical and Social Security data of almost 5.7 million people, and the Xsolis breach, tied to nine health systems and 1.4 million patients.

Vanderbilt Ransomware Attack: What the Gang Claims

On Monday, BYOD claimed responsibility on its data leak site, saying it had encrypted Vanderbilt's databases and stolen sensitive student and employee data. "If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess," the leak site reads.

BleepingComputer received a photograph of a screen showing Vanderbilt icons and a BYOD ransom note, "README_BYOD_31.txt", with a link to the leak site and contact details for the SESSION messaging platform. "Oh no, you have been compromised by BYOD :<," it reads. "We have all of your data including your backups, your entire network is compromised." It adds that every Social Security number is archived, and threatens to release the data if the university does not negotiate.

None of this is independently confirmed. Vanderbilt has not disclosed the nature of the attack or confirmed whether any data was stolen.

Reactions and What Vanderbilt Has Said

Vanderbilt's statements so far have been brief and cautious. "We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services. Our Information Technology team is actively investigating and working to contain the situation," the university said in a statement on X.

The tone on campus was urgent: staff walked into classrooms to warn lecturers not to touch school-issued devices. BleepingComputer asked Vanderbilt whether systems were encrypted and what data may have been stolen; the university had not answered by the time the report was published. Researchers note gangs like BYOD use leak sites as leverage, since the threat to publish stolen data pressures victims to pay even when backups can restore locked systems. CrowdStrike, the cybersecurity firm, is moving the other way, buying two AI security startups to defend the AI agents attackers now target.

Why It Matters

If the gang's claims are true, this would be one of the largest university data breaches in recent years. Over a million Social Security numbers, with names, emails, phone numbers, work addresses, roles and birthdays, would give criminals the raw material for large-scale identity theft. Social Security numbers cannot easily be changed, and once published they can circulate for years.

It also matters because Vanderbilt is a major research university holding years of research data, some unpublished and some publicly funded. The gang's claim to hold its "entire estate and research data" raises the stakes beyond the usual ransom demand. For students and staff, the risk is practical: locked systems, disrupted classes and possibly exposed personal data.

What Happens Next

Vanderbilt's IT team is working to contain the incident, determine what was accessed and restore systems, but the university has given no timeline for full service to return. The next updates are likely to say whether the gang's claims about stolen data are accurate and whether systems were encrypted. Anyone at Vanderbilt who saw a suspicious pop-up, a missing or altered file, or an unexpected login request should shut the device down and contact the IT service desk. Students and staff should also watch for phishing messages after the breach. Classes continue normally, and the university will keep the community updated. The BYOD gang has given Vanderbilt a deadline of its own: negotiate, or the stolen data goes public.

Frequently Asked Questions

What happened at Vanderbilt University?
Vanderbilt confirmed on Monday, November 9, 2026, an active cybersecurity incident. The BYOD gang claimed responsibility and said it stole over a million Social Security numbers.

Was student or employee data stolen?
Not confirmed. BYOD claims it stole Social Security numbers, names and emails, but Vanderbilt has not confirmed any data was stolen.

What should Vanderbilt students and staff do?
Shut down university devices, disconnect from campus Wi-Fi and watch for suspicious activity. Anyone who spots a problem should shut the device down and call the IT desk.

Who is the BYOD ransomware gang?
A new ransomware gang that emerged in September 2026. It lists five other organisations on its leak site and has claimed attacks on Michigan State and the University of New Mexico Health Sciences Center.

Are classes still running at Vanderbilt?
Yes. Campus Wi-Fi was restored by 7 p.m. on Monday, most systems stayed restricted, and Tuesday classes ran normally.