Vanderbilt University confirmed an “active cybersecurity incident” on Monday, November 9, and told users to shut down university devices as the BYOD ransomware group listed the school on its leak site. The group claims it holds more than one million Social Security numbers and has taken over the university’s data center.
Vanderbilt Tells Users to Shut Down Devices and Leave Wi-Fi
The university instructed students and staff to shut down university-owned devices, disconnect from university Wi-Fi and watch for suspicious activity. The steps point to an effort to contain the incident across campus systems and cloud services while the investigation proceeds.
Vanderbilt has not confirmed that its systems were encrypted or that data was stolen. The investigation is under way.
BYOD Leak-Site Claims Cover SSNs, Research Data and Backups
BYOD’s listing says the group obtained more than one million Social Security numbers, along with names, email addresses, phone numbers, student and employee records and research data. It also claims a “full takeover” of the data center, with encrypted databases and backups.
None of these claims has been verified. Ransomware groups routinely overstate or selectively describe what they hold, and the figure of more than one million Social Security numbers remains the gang’s assertion until Vanderbilt or an independent party confirms it.
BYOD Group Adds Its Sixth Leak-Site Victim in 2026
BYOD is a ransomware group that emerged in 2026, and Vanderbilt is its sixth victim on its leak site. Last month the group attacked the University of New Mexico Health Sciences Center, an incident that disrupted patient care. The two cases show the group moving through large institutions that hold sensitive personal and health information.
What the Vanderbilt Incident Puts at Stake for Students and Employees
If the claim proves accurate, the exposed data would span multiple populations: students, employees and researchers. Social Security numbers, names and contact details together give criminals the ingredients for identity theft and targeted phishing, and the university’s instruction to watch for suspicious activity reflects that risk.
Research data is a separate concern. The listing names it among the stolen material, but Vanderbilt has not said what research systems, if any, were affected, and the claim covers no specific projects.
The claim of encrypted backups also matters to recovery. Ransomware operators who reach backup systems limit a victim’s ability to restore without paying, which is why the group highlights them. Vanderbilt has not addressed whether its backups are intact.
Universities have been recurring ransomware targets because they combine large user populations, open networks and valuable personal records. In Vanderbilt’s case, the university’s own guidance to isolate devices and leave campus Wi-Fi suggests the incident touched systems widely used across the institution rather than a single department.
Open questions include when the intrusion began, whether data left the network and what the group is demanding. The reporting does not mention a ransom figure or deadline on the leak-site listing. Vanderbilt’s next statement will need to settle whether the incident involved encryption, data theft or both.
How BYOD Compares With Its Earlier Targets
Before Vanderbilt, the group’s most recent publicized attack hit the University of New Mexico Health Sciences Center, which disrupted patient care. That attack came last month. Vanderbilt’s leak-site entry makes it the sixth organization the group has named since it appeared this year, and the two institutions it has hit most recently are both large academic organizations.
The university has not said which systems or cloud services are down beyond telling users to power off university devices and leave its Wi-Fi network. Because Vanderbilt has confirmed only an active incident, every claim about the volume and type of stolen records, and about the data center takeover, remains the ransomware group’s own account of events.
