Vanderbilt BYOD: 1 million SSNs claimed

Vanderbilt University told its campus on Monday, November 9, 2026, that an active cybersecurity incident may affect university devices, systems, and cloud services. The 10:45 a.m. notice asked students, faculty, and staff to shut university devices down, leave university Wi-Fi, and watch for anything on the screen they did not start. By 7:15 p.m. campus Wi-Fi was available again. Most Vanderbilt systems and applications were still restricted. Classes on Tuesday, November 10, stay on a normal schedule.

What BYOD says, and what the university has confirmed

The BYOD ransomware gang posted Vanderbilt on its leak site the same day. The post says the university’s databases are locked and that the gang holds research data and student and employee records: more than a million Social Security numbers, plus names, email addresses, and phone numbers. It also claims control of the directory that signs the campus in. BleepingComputer reviewed a photograph of a screen showing Vanderbilt icons and a BYOD ransom note, and it checked that the address in the note belongs to the gang’s site.

Vanderbilt’s own updates confirm the incident and the containment work. The name BYOD, the encryption, and the theft of Social Security numbers are in the gang’s post and in that photograph. BleepingComputer asked the university whether systems were encrypted, what data may have left, and whether the incident was contained, and as of its report it was still waiting on answers. The million-record figure stays the gang’s claim until Vanderbilt’s count says otherwise.

BYOD is a gang that appeared in 2026. Its leak site lists five other organizations beside Vanderbilt. A listing is an allegation until the victim, or a file sample, says otherwise.

What changed between morning and evening

The morning instructions were specific. Unexpected pop-ups, warnings, or security notices are a reason to stop. So are files, folders, or permissions that changed in OneDrive, Box, or another cloud drive; files that moved, disappeared, or were renamed; unfamiliar applications; and a password or login-approval prompt the person did not request.

Anyone who sees that should leave the prompt alone, skip any local cleanup, shut the device down, and call the IT service desk from a different device or a telephone.

The 1 p.m. note kept classes on the schedule. The 7:15 p.m. note restored Wi-Fi and left most systems and applications restricted. Vanderbilt Information Technology said it is working with government agencies and other partners. Students were told to ask instructors about deadline flexibility. Student services, including the Student Care Network, stay open. Faculty with a grant due this week were pointed to the vice provost for research and innovation. Staff report to work as scheduled. The university said the next update, including which systems are back, would come by 9 a.m. Tuesday.

A laptop that joins campus Wi-Fi on Tuesday is still inside an open incident. Records, research, and file applications are the part the university has held back.

What to do while the theft is unconfirmed

Leave a university device powered off if it shows a ransom note, a file you did not change, or a prompt asking for a password. Report it to the IT service desk from a phone that is not that device. Pay nothing from the screen, and run nothing that claims it will unlock the files.

Read status on Vanderbilt’s own news site. A message that uses this incident to ask for a Social Security number, a password, or an authentication approval is the follow-on a claim like BYOD’s is built to produce. Type nothing into the pop-up. The university’s notices say to shut the device down and call.

Keep research files, grades, and payroll on university systems while those systems are restricted. A personal cloud account opened to finish Tuesday’s work is a second copy outside the response. Faculty on a grant deadline should use the research office channel the university already named.

Other campuses can copy the split Vanderbilt published: a hard stop on university devices in the morning, a public clock for the next status note, and a clear line between a gang’s leak-site post and what the institution has verified. Watch OneDrive and Box for permission changes. When a gang’s note appears on a lab machine, that machine stays off until the response team has it.

This briefing relies on public reporting by BleepingComputer and on Vanderbilt’s November 9 updates.