Ransomware Group BYOD Claims It Stole Data on 1 Million People From Vanderbilt

Vanderbilt University told students and employees to power down school-issued computers and sever connections to campus Wi-Fi on Monday as it investigated what outside observers describe as an apparent ransomware intrusion, with a cybercrime crew claiming it made off with records on more than a million people tied to the Nashville institution.

The university said its IT staff were "actively investigating and working to contain the situation," and asked the campus community to remain "extremely vigilant." In a separate notice, administrators warned users not to try to fix the problem on their own. "SHUT DOWN YOUR DEVICE IMMEDIATELY to help prevent potential further security risks," the school said, adding that IT personnel were fanning out to warn faculty in person. Users were also told to close any open Microsoft Word documents and OneDrive or Dropbox folders.

Vanderbilt Health, which runs independently of the university, instructed its employees to stay out of university IT systems until further notice. It said its own networks were untouched and that patient care was proceeding normally.

A group calling itself BYOD took credit in a ransom note posted to Ransomware.live, a site that aggregates publicly visible information on cyberattacks. The outfit said it held the school's databases, describing a haul that included Social Security numbers, full names, email addresses, phone numbers and student and employee records. "We have your entire estate and research data," the message read. "Anyways, you know where to find us ( tab)." The moniker mocks "bring your own device" policies that let people reach corporate networks through personal hardware.

Vanderbilt has not confirmed the group's involvement or said whether any information was actually compromised. Its press office did not immediately respond to a request for .

Warning signs the school flagged include unexpected pop-ups and warnings, files or permissions altered in cloud storage, files moved, deleted or modified without explanation, and unfamiliar apps or messages appearing on devices. Campus officials said classes were continuing as scheduled, though some instructors canceled sessions anyway, according to the student newspaper.

Note: Vanderbilt has not verified the attackers' claims or the scope of any data loss.

Universities have become prized targets for extortion gangs, which weigh the volume of sensitive records they hold against the steep cost of shutting down research and administrative operations, much as hospitals are. Sprawling, decentralized networks that mix student-owned hardware with third-party service providers give security teams limited visibility and control, leaving institutions able to contain such risk rather than eliminate it.

BYOD has previously claimed responsibility for intrusions at Michigan State University and the University of New Mexico Health System, a pattern that suggests the group specializes in education and health-care targets with large stores of personal data.

For Vanderbilt, the immediate priority is determining whether the claim is genuine and what, if anything, left its systems. A confirmed breach involving Social Security numbers would expose the school to notification obligations, regulatory scrutiny and potential litigation, and it would put students and staff at risk of identity fraud. The disruption itself carries costs: halted research, canceled instruction and IT remediation that can stretch for weeks. The episode also lands as a caution for other institutions weighing how much access to grant personal devices, since every added endpoint widens the perimeter an attacker can probe.