Vanderbilt restores systems after BYOD ransomware attack

Vanderbilt University is restoring campus systems after a cyberattack attributed to the BYOD ransomware group. The attackers claim they encrypted databases and obtained personal data including more than one million Social Security numbers, names, email addresses, phone numbers, student and employee records, and research data, and that they gained domain controller access and backups.

Vanderbilt’s own update notes that the specifics of what data was accessed are still being determined, and the university has not confirmed the claimed data volume. The exact method of initial access has not been disclosed.

Available systems and applications at the time of the incident included Campus Wi‑Fi, Okta with MFA, Vanderbilt email on university and personal devices, CampusPrint, Brightspace, Zoom, and YES (Your Enrollment Services), with course registration proceeding as normal. Other systems remained restricted, and full restoration could take several weeks. BYOD has threatened to release the purported data, and the university emphasises following official IT guidance and remaining vigilant for suspicious messages.

The article notes that BYOD’s claims are not yet verified by Vanderbilt, and the university continues to assess what data, if any, was accessed and what impact this may have on affected individuals. The piece also references external reporting from Bleeping Computer about the alleged data theft and access to a domain controller.