Osegi
Security·2 min read

Vanderbilt University Hit by Suspected Ransomware Attack

Vanderbilt told students and staff to shut down devices after a suspected ransomware attack. A group called BYOD claims it stole data on over a million people.

Students walking across a university campus while a laptop screen shows a ransomware warning message.
Image: Gizmodo
SUMODialoediviewergiftdetect

Vanderbilt University told students and faculty on Monday to disconnect from campus Wi-Fi and shut down their devices after a suspected ransomware attack. A group calling itself BYOD claims it stole data on more than a million people tied to the university.

Shortly after 10:00 a.m. local time, Blair School of Music Dean Melissa Rose told students that everyone was following university protocols and waiting for instructions. "For now, we are simply asking everyone to stay off the network entirely until we know more," she said. Another university notice warned users not to investigate or fix the problem themselves and to "SHUT DOWN YOUR DEVICE IMMEDIATELY." IT staff were also sent to warn faculty, and users were asked to close Microsoft Word documents and OneDrive and Dropbox folders.

What the attackers claim

Students with university-issued devices reported ransom readme files and popups filling their desktops. One person said their files were rewritten into an encoded ".byod" format, and a researcher said work hosted on university systems was inaccessible, forcing a switch to personal backups.

A ransom message posted to Ransomware.live, which aggregates public information on cyberattacks, says the group holds "over 1 Million SSNs," names, email addresses, phone numbers, and student and employee records, plus full takeover of the domain controller. These claims are unverified, and it is unclear how much data was actually lost.

Why it matters

The group's name mocks "Bring Your Own Device" policies, which trade cost and convenience for a larger attack surface because security teams have little control over personal devices. Universities, with many students and third-party providers, are especially exposed. Like hospitals, they are favored ransomware targets because of the volume of data they hold and the high cost of disruption. BYOD has previously claimed attacks on Michigan State University and the University of New Mexico Health System.

The university has said classes are "proceeding as scheduled," though some professors reportedly canceled sessions. Vanderbilt's press office had not responded to a request for comment.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:vanderbiltransomwarebyoddata breachuniversities

More from this day

See all →

More in: Security

See all →