Vanderbilt University Tells Campus to Shut Down Devices as BYOD Ransomware Gang Claims 1 Million SSNs, Research Data and Backups
Vanderbilt University ordered students and staff to shut down devices and leave campus Wi-Fi during an active cyberattack as the new BYOD ransomware gang claimed to have stolen over a million Social Security numbers and the university's backups.
Vanderbilt University in Nashville told students, faculty and staff on Monday, 9 November 2026, to shut down university devices and disconnect from campus Wi-Fi while it responds to an active cyberattack. The same day, a ransomware group calling itself BYOD listed the university on its leak site, claiming to hold more than a million Social Security numbers, the university's research data and its backups.
What Happened
The university said it is "responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services" and that its IT team is "actively investigating and working to contain the situation". It urged the community to remain "extremely vigilant".
Students reported pop-up "README" tabs on university devices. A photo of an infected screen shared with reporters showed a ransom note named README_BYOD_31.txt, and a video circulating online shows infected computers playing an audio message saying the network had been compromised by "BYOD". Reporters confirmed that the link in the note leads to BYOD's leak site.
Vanderbilt has not confirmed that BYOD is responsible, whether devices were encrypted or whether any data was stolen. It is also not clear whether Vanderbilt University Medical Center is affected. VUMC is a separate organisation and was hit by a different ransomware gang in 2023.
What BYOD Claims
On its leak site, BYOD claims, without publishing samples so far, that it has:
- locked the university's databases
- the "entire estate and research data"
- more than 1 million Social Security numbers, plus names, email addresses, phone numbers and student and employee records
- control of the domain controller and the backups
The ransom note gives a Session messenger contact for negotiation and threatens to leak data and cause more disruption if the university does not respond. Treat these claims as unverified until the university or published data confirms them. Ransomware groups often exaggerate to increase pressure.
Who Is BYOD?
BYOD is a new group that first appeared in 2026. Researchers who track ransomware say its first known victim was posted on 29 September and that its activity has picked up quickly since then. Its leak site lists only a handful of other organisations, but they are high-profile:
- University of New Mexico Health Sciences Center (October), where outages disrupted patient care and a hospital diverted ambulances
- Michigan State University, where a similar file-renaming pattern was reported
- Trump Mobile, where the group is believed to have leaked data on 3,615 prominent customers, drawing Congressional scrutiny
Technical details of BYOD's intrusions, such as how it gets in and what encryptor it uses, have not been published.
Who Is Affected
Vanderbilt has about 14,000 students and more than 6,000 staff. Anyone with a Vanderbilt account or a university-managed device should assume disruption, and current and former students and employees should watch for follow-up phishing, whether or not data theft is confirmed.
What To Do Now
Vanderbilt community: follow the university's instructions:
- Keep university devices shut down and off university Wi-Fi until IT says otherwise.
- Watch for unexpected pop-ups, security warnings, password or MFA prompts, missing or modified files, permission changes or unfamiliar apps.
- If you see any of these, don't try to fix it yourself. Turn the device off and contact the IT service desk.
- Be suspicious of emails, texts or calls about the incident, especially ones asking you to "verify" credentials, and change any password you reused on other services.
- Consider a credit freeze if you are a current or former student or employee, since the group claims SSNs.
Other universities and hospitals: BYOD has targeted three large U.S. academic institutions in about six weeks. Now is the time to:
- confirm that backups are offline or immutable and that domain controller compromise cannot reach them
- review privileged and service account activity on domain controllers
- enforce phishing-resistant MFA on remote access and admin accounts
- rehearse a campus-wide "shut down and disconnect" message so it can go out within minutes
Why It Matters
Universities hold decades of personal records and valuable research, yet run sprawling networks with thousands of unmanaged devices. That makes them ideal targets for a fast-growing group like BYOD, which seems to be working its way through U.S. higher education and academic medicine. Industry reports show ransomware activity rising sharply in recent months, with record numbers of groups and leak-site posts. The Vanderbilt incident is still unfolding. Watch for the university's confirmation of the scope and whether BYOD starts publishing data.
