Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

Vanderbilt restores some systems after claimed BYOD ransomware attack

8 sources · 8 articlesFirst reported Updated ()
What's new

November 11: Malwarebytes reports Vanderbilt has not confirmed accessed data and says full restoration could take several weeks.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Vanderbilt is restoring selected systems after a November 9 incident; BYOD’s claimed theft of more than one million SSNs remains unconfirmed.

Vanderbilt University is bringing campus systems back online after a cybersecurity incident detected Monday, November 9, that may affect devices, systems, and cloud services. Students and staff were told to shut down university devices and leave campus Wi-Fi. The BYOD ransomware gang claims it locked databases and stole student, employee, and research data, including more than one million Social Security numbers; the university has not confirmed the gang, encryption, or theft. BleepingComputer reviewed a BYOD ransom note on a Vanderbilt-branded screen. By November 10, Wi-Fi, Okta, Outlook, Brightspace, Zoom, and YES were usable again, while other systems stayed restricted and classes continued. Malwarebytes reports full restoration could take several weeks.

Key facts
  • Incident disclosed at 10:45 a.m. CST on November 9, 2026.
  • BYOD claims more than one million SSNs, records, research data, and backups.
  • Campus Wi-Fi was available again by 7:15 p.m. on November 9.
  • Classes continued November 10; most applications remained restricted.
  • University has not confirmed encryption, the gang, or stolen data.
  • Malwarebytes says full restoration could take several weeks.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 29, 2026BYOD’s first known victim appeared, according to Allan Liska. · The Record
  2. Nov 9, 2026Vanderbilt disclosed an active incident at 10:45 a.m. CST. · Infosecurity Magazine
  3. Nov 9, 2026Campus Wi-Fi was available again by 7:15 p.m. · Cyber Security News
  4. Nov 10, 2026Classes continued; selected systems returned, others stayed restricted. · CyberScoop
  5. Nov 11, 2026Malwarebytes reported restoration could take several weeks. · Malwarebytes Labs

What each outlet adds

beyond the shared facts
  • BleepingComputerReviewed a BYOD ransom note named README_BYOD_31.txt.
  • The RecordLiska dates BYOD’s first known victim to September 29.
  • The RegisterComputers reportedly played an audio threat; ticketing was down.
  • CyberScoopStudent leaders criticized communication and asked for academic flexibility.
  • Malwarebytes LabsSays full restoration could take several weeks.
Threat actors
BYOD
Victims
Vanderbilt UniversityUniversity of New Mexico Health Sciences Center
Organizations
Venarix
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 2d ago The RecordFirst report

    Vanderbilt investigates cyberattack as BYOD claims a data leak

    Campus IT is still containing the incident, and the gang’s stolen-data claim remains unverified.

  2. · 1d ago BleepingComputer

    Vanderbilt University hit in BYOD ransomware attack, data theft claimed

    Users must shut down university devices and leave university Wi-Fi; Vanderbilt has not confirmed encryption or stolen data.

  3. · 1d ago Cyber Security News

    Vanderbilt shuts campus devices after BYOD ransomware breach claim

    The university has not confirmed theft; BYOD claims more than one million Social Security numbers and compromised backups.

  4. · 1d ago Infosecurity Magazine

    Vanderbilt takes systems offline after a cyber incident

    Classes resumed November 10, but most applications stay restricted; BYOD claims it stole over one million SSNs.

  5. · 1d ago DataBreaches.net

    Ransomware attack puts Vanderbilt University on lockdown

    The DataBreaches.net page did not load past a Cloudflare check, so no gang, systems, or ransom details are available.

  6. · 1d ago The Register · Security

    BYOD claims ransomware attack on Vanderbilt University systems

    Campus Wi-Fi is restored, most systems stay restricted, and Vanderbilt has not confirmed the claimed theft of more than 1 million SSNs.

  7. · 1d ago CyberScoop

    Vanderbilt University hit by ransomware attack claimed by BYOD

    BYOD claims more than one million Social Security numbers; some systems returned Tuesday while others stay restricted.

  8. · 2h ago Malwarebytes Labs

    Vanderbilt restores systems after attack; BYOD claims data theft

    The university has not confirmed what data was accessed and says full restoration could take several weeks.