Vanderbilt University is in the middle of an active cybersecurity incident that may impact university devices, systems and cloud-based services, and the school is telling everyone connected to it to power down and disconnect immediately. The university confirmed the breach Monday and said its technology team was racing to contain the damage before it spreads further.
“We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services,” the school said in an update posted to its website, according to Vanderbilt University. The university said its Information Technology team was “actively investigating and working to contain the situation,” and it asked everyone in the Vanderbilt community to shut down university devices, disconnect from university Wi-Fi and remain extremely vigilant. The Nashville Banner reported that the university confirmed the apparent cyberattack in a statement posted to social media.
Employees Describe Files Renamed, Ransom Warnings
Details of how the breach unfolded on individual machines began circulating this week. Per the Nashville Banner, a Vanderbilt employee reported that a computer displayed a system update notification followed by a message deleting old files, with the incident dated to last Thursday. The same employee's account also described a ransomware attack warning appearing on screen with a link for more information and computer files converted into files bearing a .byod extension.
An unidentified source told the Nashville Banner that the university's IT help line for employees had crashed amid the chaos, though that claim was attributed to a source not on the record. A ransomware group calling itself BYOD has claimed responsibility for the Vanderbilt breach in messages attributed to the group, the Banner reported, and the same group has recently claimed responsibility for cyberattacks on Michigan State University and the University of New Mexico health system.
Hackers Claim Massive Data Haul, Unverified
The student newspaper, The Vanderbilt Hustler, reported that a website attributed to BYOD claimed the group possessed more than one million Social Security numbers along with full names, email addresses, phone numbers, and student and employee records. The paper also reported that students across campus described pop-up tabs appearing on university-issued devices containing messaging similar to what was posted on BYOD's site. Those claims have not been independently verified.
Similar claims have surfaced in other recent incidents linked to the same group. The State News reported that BYOD claimed responsibility for a cybersecurity incident at Michigan State University, where the group claimed it had stolen data from 1.3 million current and former students, according to The State News, which said MSU described itself as “actively monitoring and investigating a potential cybersecurity threat.” BleepingComputer separately reported that a newly identified ransomware group called Byod had claimed an attack on the University of New Mexico Health Sciences Center, an incident that, per BleepingComputer, led the hospital system to temporarily limit new patient admissions, divert ambulances to nearby hospitals and suspend outpatient surgeries and appointments.
Patient Care Unaffected So Far, Vanderbilt Health Says
Vanderbilt Health moved quickly to separate itself from the university's IT troubles. In a statement, the health system said its own systems “so far have not been impacted,” though officials said they were continuing to monitor the university's situation closely, according to news.vumc.org. “The safety of our patients is our top priority and patient care is continuing at all our hospital and clinical locations,” the statement read. Vanderbilt Health officials said they were proceeding with the utmost care and diligence as the situation develops, according to the Nashville Banner.
The university's medical center has faced this kind of threat before. The Record reported that Vanderbilt University Medical Center was previously attacked by a ransomware gang in 2023, a fact noted amid broader concerns about repeated targeting of the institution, according to The Record.
Part of a Surging National Threat
Vanderbilt's breach lands amid a sharp rise in ransomware attacks on schools and universities nationwide. Ransomware attacks against schools, colleges and universities rose 23% year over year in the first half of 2025, according to Comparitech data cited by Higher Ed Dive, which counted 130 confirmed and unconfirmed ransomware attacks against educational institutions during that period, with an average ransom demand of $556,000. The Record also reported that Halcyon tracked a 40% increase in ransomware activity between July and September, with 111 groups claiming 2,766 attacks against organizations across 122 countries.
For now, Vanderbilt students, faculty and staff are being told to stay off university networks and watch for suspicious activity while the school's IT team works to contain the breach. The university has not said when normal access to its systems will be restored.
