Vanderbilt Addresses Active Cybersecurity Incident, Most Systems Remain Restricted
Vanderbilt University confirmed an active cybersecurity incident. Wi‑Fi is working again, but access to most systems and applications remains restricted.
Vanderbilt University’s cybersecurity incident has restricted access to most university systems and applications. On November 9, the university confirmed that the event could affect its devices, systems and cloud services, while the IT team works to limit the impact and restore operations.
In its initial alert, the school urged students and employees to turn off university devices and disconnect from university Wi‑Fi. In an evening update, it announced that the wireless network was available again. Access to most systems and applications, however, remains restricted.
Vanderbilt University cybersecurity incident restricts services
Vanderbilt did not specify which systems and applications are unavailable or the full scope of the impact. It confirmed, however, that it is working with government agencies and other partners to address the incident.
Classes are expected to continue, according to the university. The school also recommended flexibility with student assignment deadlines given the limited access to digital services. The outages may affect instruction, administrative processes and research, as Vanderbilt is a major research university.
According to a statement provided to WSMV, Vanderbilt Health operates on separate systems and, according to available information, was not affected.
BYOD group claims responsibility; attribution unconfirmed
The BYOD group publicly claimed responsibility for the attack. BleepingComputer reported that its message also appeared on an allegedly affected device. Vanderbilt University itself has not confirmed the group’s involvement.
BYOD also claims to have stolen research, student and employee data, including more than one million Social Security numbers. This claim has not been independently verified, and the university has not confirmed it. It is likewise unconfirmed whether databases or other systems were encrypted.
The cause of the incident, the precise scope of the affected services and any obligation to notify affected individuals or regulators about a personal-data breach are also unknown.
What comes next
The university’s next morning update should show whether access to additional systems and applications is being restored. The results of the forensic investigation will also be important and could confirm or disprove BYOD’s involvement, system encryption and possible data exfiltration.
Vanderbilt’s current instructions remain in effect for members of the university community. Wi‑Fi availability alone does not mean that other university services have been restored; the school continues to describe access to them as restricted.
Sources
- Vanderbilt University — Nov. 9: Active Cybersecurity Incident Updates – Confirms the active incident, the initial instructions to turn off devices, subsequent Wi‑Fi availability, restrictions affecting most systems and cooperation with government agencies.
- BleepingComputer — Vanderbilt University hit in BYOD ransomware attack, data theft claimed – Documents the BYOD group’s public claims and evidence in the form of a ransom note; it also states that Vanderbilt did not confirm attribution, encryption or data theft.
- WSMV — Vanderbilt Wi‑Fi now available as access to school systems remains restricted – Corroborates the system restrictions, the continuation of classes and Vanderbilt Health’s statement that its separate IT systems were not affected, according to available information.
Verified and updated: 11/10/2026 06:30
