Vanderbilt restores some services after ransomware attack

Vanderbilt restored campus WiFi by Monday evening and cleared Brightspace and the YES student portal for use later that night. OneDrive and Box remained affected. The university said classes and student services would follow their usual Tuesday schedule, and advised students struggling to complete assignments to ask instructors about extensions. A person told the Nashville Scene they had lost access to research stored on university systems and were relying on personal backups.

Vanderbilt has not said how its IT team first detected the attack. BleepingComputer published an alleged ransom note from a university computer in which a group calling itself BYOD claimed responsibility. The group said it had taken Vanderbilt’s databases and research data, and claimed to have stolen more than 1 million Social Security numbers as well as student and employee records. A separate note threatened to release data unless the university negotiated.

The claims remain unverified. A Vanderbilt spokesperson told The Washington Post that the university had not confirmed them. In an update posted to X on Tuesday morning, Vanderbilt said its Information Technology team was working with government agencies and other partners to manage the situation and promised further updates.

The attack followed a similar incident at the University of New Mexico Health Sciences Center on Oct. 26. Employees there told the Associated Press that a voice message on work computers claimed student, employee and patient information had been stolen; BYOD also claimed responsibility. UNM Health diverted ambulances and temporarily suspended outpatient surgeries and appointments. The university later said its investigation found the attack affected some staff and student devices but did not reach core systems or servers. Vanderbilt has not said whether any personal information was exposed.