Vanderbilt University shuts down campus systems after BYOD ransomware attack (2026)

On 9 November 2026, Vanderbilt University — the private research university in Nashville, Tennessee — confirmed an "active cybersecurity incident" and instructed students, faculty and staff to power down university devices and disconnect from campus Wi-Fi while its IT team worked to contain the intrusion. The disruption spread across the university's digital networks, with devices, systems and cloud-based services all potentially affected.

What happened

On the affected machines, employees reported seeing a fake "system update" screen that gave way to a ransom warning, with files renamed using a .byod extension. Files stored in the university's Box cloud platform were deleted, including accreditation information and admissions materials, and the IT help line was overwhelmed. The ransomware group BYOD — a gang that emerged in September 2026 and has also claimed intrusions at Michigan State University and the University of New Mexico Health System — claimed responsibility and asserted it had stolen more than one million Social Security numbers. Vanderbilt has not confirmed that claim or the scope of any data theft, and its own statements have avoided the word "ransomware."

Response

Vanderbilt said its IT staff were investigating and containing the incident in coordination with government agencies and other partners. Campus Wi-Fi was restored on the evening of 9 November, but access to most university systems remained restricted into the following day, when classes continued as scheduled. Vanderbilt Health said its hospital and clinical facilities were not affected by the attack.

Why it matters

Universities make attractive ransomware targets: they hold large stores of personal and research data, run sprawling and heterogeneous networks, and cannot easily go offline. The visible hallmarks here — deleted cloud files, ransom banners on staff machines and a branded file extension — point to a destructive, attention-seeking operation rather than a quiet data theft. If BYOD's claim of more than a million Social Security numbers proves accurate, the incident could expose a broad population of current and former students, staff and affiliates to identity-fraud risk long after campus systems are restored.