Vanderbilt tells everyone to shut down devices in active cyberattack

Updated 10 November, 02:45 UTC. Corrected: the first notice came at 10:45 a.m., not 11:19; added the WiFi restoration and the BYOD ransom note.

Vanderbilt University says it is fighting an active cybersecurity incident and has asked everyone at the university to shut down university devices and disconnect from university WiFi. In its first notice at 10:45 Nashville time on Monday (16:45 UTC), the university said the incident may affect university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it.

By the evening, Vanderbilt had restored campus WiFi, but access to most university systems and applications remained restricted, its 7:15 p.m. update said. Its IT team is working with government agencies and other partners, and the university planned to run on a normal schedule on Tuesday, with the next update due by 9 a.m.

What Vanderbilt is telling people

The university lists signs to watch for: unexpected pop-ups or security warnings, unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage, files that have been moved, deleted, renamed or changed, unfamiliar applications or prompts, and unexpected requests for passwords, logins or authentication approvals. Anyone who sees them is told not to click anything, not to try to fix it, to shut the device down at once and to call the IT service desk from a different device or phone. The notice does not say when normal use can resume.

The Nashville university has about 14,000 students and more than 6,000 staff, according to Recorded Future News. Its spokesperson told the outlet that the IT team is "actively investigating and working to contain the situation".

The ransomware claim

Vanderbilt's notices do not name a group or mention ransomware. The ransomware group BYOD added the university to its leak site earlier on Monday and made several claims about stolen data, Recorded Future News reported. Vanderbilt has not confirmed the claim or said whether any data was taken.

BleepingComputer has since received a photograph of a screen showing Vanderbilt icons and a BYOD ransom note named README_BYOD_31.txt, and says the leak site linked in the note is the one BYOD runs. The note says the group has the university's data and backups, including student and employee records with Social Security numbers. On its leak site BYOD claims to have locked Vanderbilt's databases and taken data including more than 1 million Social Security numbers. These are the group's claims and have not been confirmed.

BYOD first posted a victim on September 29, according to ransomware researcher Allan Liska, and has since claimed attacks on Michigan State University and the University of New Mexico, where the incident forced the university hospital to divert ambulances.

What is not known

Vanderbilt has not said how the intrusion started, how many devices or systems are affected, or whether Vanderbilt University Medical Center, a separate organisation, is affected.