Vanderbilt takes systems offline after cyber incident

Vanderbilt University in Nashville has taken systems and applications offline after a cyber incident was detected at 10:45am CST on 9 November 2026. The university’s update urged the campus community to shut down university devices, disconnect from university Wi‑Fi, and remain vigilant for unusual or suspicious activity, including unexpected pop-ups, changes to files or permissions in cloud storage, and unusual password or authentication prompts.

A subsequent update at 7.15pm CST on 9 November stated that classes would proceed on 10 November and student services would operate normally, with campus Wi‑Fi confirmed as available, though access to most systems remained restricted as Vanderbilt IT works with government agencies and partners to manage the situation.

Cyber intelligence firm Venarix claimed on X that BYOD ransomware group has listed Vanderbilt University on its data leak site, asserting that the attackers locked the university’s databases and accessed substantial data, including Vanderbilt’s research data, more than one million Social Security numbers, and comprehensive student and employee records, with a full takeover of the university’s domain controller. Vanderbilt did not disclose details of the incident or the alleged perpetrator in its communications.

The university’s reporting about the event and subsequent updates also mentioned that the Vanderbilt Hustler reported IT staff had entered classrooms and warned that school-issued computers were not safe to use. The company or outlet behind Venarix’s assertion, and the extent of data exposed, are not independently corroborated within the university's updates.