Vanderbilt University in Nashville is working to restore normal operations after a cyberattack that compromised university devices, systems and cloud services. The breach, claimed by a ransomware group called BYOD, allegedly exfiltrated more than a million social security numbers along with names, email addresses, phone numbers and other records belonging to students, faculty and staff.

University response and current status

By Tuesday morning, the university announced that Wi‑Fi on campus is available again, but most other systems and applications remain restricted. Vanderbilt IT continues to collaborate with government agencies and other partners to contain the incident and will provide updates throughout the week.

Students, staff and faculty can now access personal accounts such as Google accounts, while services like CampusPrint remain offline. The university urges anyone who notices suspicious activity—unexpected pop‑ups, file changes, unfamiliar applications, or password prompts—to shut down the device immediately and contact the IT Service Desk at 615‑343‑9999 from a separate device.

Ransomware group claims responsibility

According to ransomware tracking site Ransomware.live, the BYOD group claims responsibility for the attack. Cyber‑security firm CyberXTron identifies BYOD as a new ransomware operation that first appeared in September. The group’s typical pattern involves stealing data and then publishing it on a leak site to pressure victims.

CyberXTron also noted that BYOD listed Trump Mobile—a wireless service launched by Donald Trump Jr. and Eric Trump—as a high‑profile victim.

Impact on university operations

Vanderbilt has asked its community to shut down university devices and disconnect from campus Wi‑Fi while the investigation continues. Classes are scheduled to proceed as normal, and student services remain open. Faculty with grant deadlines are advised to contact Vice Provost for Research and Innovation Susan Marguiles for support.

Vanderbilt Health, a separate legal entity, confirmed that its systems have not been impacted and patient care continues without interruption.

What to do if you suspect a breach

The university recommends not clicking unknown links or attachments, avoiding unfamiliar prompts, and reporting any unusual activity to the IT Service Desk. Ongoing monitoring and containment efforts are in place to protect the university community.

Original reporting: Action News 5 WMC (Gray) — read the source article.