Vanderbilt University Takes Systems Offline After Cyber Incident

Vanderbilt University has been hit by a cyber incident, resulting in systems and applications being taken offline.

The Nashville-based institution disclosed that it was responding to an active incident at 10.45am CST on November 9, which it said may impact university devices, systems and cloud-based services.

“We are asking all members of the university community to shut down university devices, disconnect from university WiFi, and remain extremely vigilant. Take immediate action if you notice any unusual or suspicious activity on your devices,” the University wrote in the update on its website.

Such suspicious activity included unexpected pop-ups, warnings or security notifications; unusual changes to files, folders, or permissions in cloud storage platforms; and unexpected requests to enter passwords or approve authentication requests.

A later update by Vanderbilt at 7.15pm CST confirmed that classes will proceed on a normal schedule from November 10, while student services will also be operating normally. Campus WiFi was also confirmed to be available.

However, access to most Vanderbilt systems and applications remains restricted.

“We know this has disrupted important work and caused frustration across the university. Vanderbilt Information Technology is working with government agencies and other partners to manage this situation,” the update added.

The Vanderbilt Hustler, the official student newspaper for Vanderbilt University, reported on November 9 that university IT staff entered classrooms across campus, alerting that school-issued computers were not safe to use.

Read now: Copenhagen University Breach Compromises Data on Half a Million People

Vanderbilt Incident Claimed by BYOD Ransomware

Vanderbilt did not give any details on the nature of the incident, or any alleged perpetrator. However, cyber intelligence firm Venarix reported on X that the BYOD ransomware gang has listed Vanderbilt University on its data leak site.

The group claimed to have locked the university’s databases and accessed a vast volume of data held in its systems.

This includes Vanderbilt’s research data, over one million social security numbers, full names, emails, phone numbers, student and employee records, and a full takeover of the university’s domain controller.

The incident comes shortly after BYOD claimed an attack on the University of New Mexico Health Sciences Center (UNM HSC) at the end of October 2026, which resulted in the cancellation of surgeries and diversion of ambulances.

The most recent update by UNM regarding the incident said it “did not make any concessions with any group behind the threat.”

All clinical operations across the institution are now fully functional following the incident.

Image credit: Barbara Kalbfleisch / Shutterstock.com