Vanderbilt Probes Ransomware Claims

Vanderbilt University has confirmed it is working through an active cybersecurity incident, and a relatively new ransomware operation is already claiming credit for it. The BYOD ransomware group says it encrypted the university's databases and made off with sensitive records covering students and employees — claims the school has so far declined to confirm or deny.

What Vanderbilt has acknowledged is a response still in motion, with devices and cloud services potentially touched, and a set of instructions sent to the campus community that reads more like containment than clean-up.

Campus Told to Power Down

In a statement posted on X on Monday, the university said its technology staff was investigating what it described as an active incident, and warned that university-owned devices, systems, and cloud-based services could all be affected.

The guidance that followed was blunt. Students, faculty, and staff were told to shut down university devices, disconnect from the campus Wi-Fi network, and stay alert for signs that a machine or account had been compromised.

Those signs, according to the university, include unexpected pop-ups or security notifications, unusual changes to files or permissions inside cloud storage platforms, files that have gone missing or been altered, applications nobody installed, and authentication requests that come out of nowhere.

Anyone spotting that kind of activity was told not to dig into it personally. Instead, the instruction was to power the device down immediately and call the university's IT service desk.

Gang Says It Has Everything

The BYOD ransomware group posted its claim on its data leak site on Monday, asserting that it had locked Vanderbilt's databases and taken sensitive information belonging to students and employees.

The message on the leak site was written to taunt, and it put a specific number on the data it says it holds — more than 1 Million SSNs — alongside full names, email addresses, phone numbers, and student and employee records. The group also claimed a full takeover of the university's domain controller and said that whatever was on the network is now in its possession.

"If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess,"

— the BYOD ransomware group, in a message posted to its data leak site

A Ransom Note in the Wild

BleepingComputer reported that it has since obtained a photograph of a computer screen that appears to belong to a Vanderbilt machine. The screen shows icons tied to the university and an open ransom note titled README_BYOD_31.txt.

The note points readers to the BYOD data leak site and gives contact details for the SESSION encrypted messaging platform, where the gang negotiates with victims. BleepingComputer said it verified that the link in the note leads to the site BYOD actually operates.

Its opening line is styled as a taunt rather than a demand: "Oh no, you have been compromised by BYOD :<".

From there the note repeats the group's inventory of stolen material, saying the data covers both student and employee populations, that every Social Security number has been archived, and that names, email addresses, phone numbers, work addresses, roles, birthdays, and "quite literally everything" are included.

It also threatens to release the data and cause further disruption if the university does not open negotiations with the attackers.

Infected Machines Read Aloud

Alongside the note, a video shared on YouTube and provided to BleepingComputer shows infected devices playing audio that warns the network has been compromised by "BYOD".

The ransom note and the video both point to BYOD as the responsible party. Vanderbilt has not publicly confirmed the group's involvement, nor has it said whether any of its devices were actually encrypted.

That gap matters. A leak-site post is a claim, not a finding, and it is common for ransomware crews to embellish what they took or to overstate how deep they got. The photograph and the audio are consistent with an intrusion, but they do not establish on their own how much data left the network or whether backups survived.

What Vanderbilt Has Not Said

Beyond the X statement and the device-shutdown instructions, Vanderbilt has kept quiet on the essentials. The university has not described the nature of the attack, has not confirmed whether data was stolen, and has not said whether the incident has been contained.

BleepingComputer said it contacted Vanderbilt with questions about whether systems were encrypted, what data may have been taken, and whether the incident was over. The outlet also published a Signal number — 646-961-3731 — and an email address for confidential tips about this incident or other undisclosed attacks.

For anyone on campus trying to judge their own exposure, that silence is the practical problem. The university's guidance covers what to do if a device behaves strangely, but not what to do if you believe your Social Security number was in a dataset a criminal group now says it holds.

BYOD's Short Track Record

BYOD is a relatively new ransomware gang, having launched in 2026. Its data leak site currently lists 5 other organizations besides Vanderbilt.

One of those prior claims involved the attack on the University of New Mexico Health Sciences Center, which caused system outages and disrupted patient care and academic activities. That claim came last month, according to BleepingComputer's reporting.

Higher education has characteristics that suit this kind of intrusion: large populations of people whose personal records are held indefinitely, research stores with value outside the institution, and IT estates that mix managed and personally owned hardware. Vanderbilt's own advisory reflects that last point — the warning covers university devices and the cloud services they reach into, and it treats a shutdown as the first move rather than a last resort.

The Numbers in the Claim

The public record so far contains a small set of hard figures, most of them supplied by the attackers rather than the victim:

• 1 Million — the number of SSNs BYOD says it holds, described as "over" that figure
• 5 other organizations — the current count of victims listed on BYOD's data leak site, before Vanderbilt
• 2026 — the year the BYOD gang launched
• README_BYOD_31.txt — the filename of the ransom note seen on the alleged Vanderbilt screen
• 646-961-3731 — the Signal number BleepingComputer published for confidential tips

Vanderbilt itself has not put a number on anything: not affected systems, not records, not the scope of the shutdown. Until it does, the only figures in circulation come from the group making the claim.

Why This Matters Beyond One Campus

The immediate consequences fall on people whose data may sit in the claimed haul. If the group's inventory is accurate, names, Social Security numbers, contact details, and employment records for students and staff would be in criminal hands — the raw material for identity fraud, targeted phishing, and credential attacks against other accounts that reuse the same details.

For the university, the next phase is likely to be defined by verification: determining what was actually taken, whether backups are intact, and how to communicate with tens of thousands of people whose records may be involved. Institutions that have been through this often find the disclosure and notification work outlasts the technical recovery.

The broader read is less about BYOD specifically than about how quickly a young crew can put a major research university on its leak site. A gang that launched in 2026 and lists only 5 other victims has now attached its name to an institution of Vanderbilt's profile. That this appears to be the group's second higher-education claim in quick succession suggests campuses are being treated as productive targets rather than opportunistic ones. Whether Vanderbilt's containment holds, and whether the data claim survives scrutiny, will shape how much of that turns out to be true.