
Vanderbilt University hit in BYOD ransomware attack, data theft claimed
Users must shut down university devices and leave university Wi-Fi; Vanderbilt has not confirmed encryption or stolen data.
9 stories, newest first · one card per story

Users must shut down university devices and leave university Wi-Fi; Vanderbilt has not confirmed encryption or stolen data.
Archived webform submissions from 2007 through October 2026 were taken across 14 faculties, and no group has claimed the attack.

VECERT says the operator used 1,438 FOFA accounts to find exposed secrets and run a campus-card fraud bot.
Hackers copied records via an ETS file-transfer site from May 22 to September 18; the state is notifying families through November.

Access ran from May 22 to September 18, 2026, and the files did not include SSNs or payment data.

Stolen SFTP logins were used between May 22 and September 18; Social Security numbers and financial data were not included.
A compromised Educational Testing Service login exposed personal data on 7 million California public-school students.

Microsoft signed legally binding AI privacy and safety standards for schools with the American Federation of Teachers, effective November 1.

Microsoft agreed to enforceable AI safety and privacy principles with the AFT and UFT after New York City and Los Angeles imposed one-year bans on student-facing AI.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views