Vanderbilt University Confirms Cyberattack After BYOD Gang Claims Theft of 1 Million SSNs

Vanderbilt University confirmed on November 9, 2026, that it is responding to an active cybersecurity incident affecting campus devices, systems, and cloud services, hours after the BYOD ransomware gang posted a claim that it had stolen more than 1 million Social Security numbers along with names, email addresses, phone numbers, and student, employee, and research records from the Nashville-based school.

The disclosure adds Vanderbilt to a growing list of universities hit by ransomware crews chasing the large troves of personal and financial data that schools accumulate through financial aid, payroll, admissions, and research-grant systems. Higher-education networks are also notoriously hard to lock down: thousands of personally owned devices, decentralized IT departments across academic units, and limited budgets for enterprise security tooling make campuses an easier target than a typical corporation.

According to BleepingComputer, which reviewed a photo of a ransom note left on a Vanderbilt-connected screen and a video of infected machines playing an audio message naming the attackers, the note — titled README_BYOD_31.txt — claims the group holds «all of your data including your backups,» along with archived Social Security numbers, birthdays, home addresses, and job roles for students, faculty, and staff. BleepingComputer independently confirmed the note's embedded link leads to BYOD's dark-web leak site.

Vanderbilt has told students, faculty, and staff to shut down university-owned devices, disconnect from campus Wi-Fi, and watch for suspicious activity, warning that anyone who notices signs of compromise should not attempt to troubleshoot the problem themselves and should instead power down the device and contact the university's IT service desk. The university has not confirmed that any data was actually stolen, that systems were encrypted, or that BYOD was the group responsible — it has described the situation only as an «active cybersecurity incident» under investigation.

BYOD is a relatively young extortion operation that first surfaced in 2026 and has built its short track record almost entirely around higher education and healthcare. It has already claimed responsibility for an October attack on the University of New Mexico's Health Sciences Center, which reportedly disrupted hospital operations, and lists several other organizations on its leak site alongside Vanderbilt.

If the group's claims hold up, Vanderbilt would become one of the largest university breaches of the year by volume of exposed Social Security numbers, placing it alongside recent mega-incidents at other U.S. colleges and state education departments. For the roughly tens of thousands of current students, alumni, faculty, and staff whose records Vanderbilt holds, an SSN-heavy leak raises the risk of tax fraud and identity theft long after any ransom dispute is resolved — a risk that normally persists regardless of whether an institution pays. Class-action law firms typically move quickly after this kind of disclosure, and Vanderbilt will likely face pressure to offer credit monitoring once it confirms the scope of what was taken.

As reported by BleepingComputer, Vanderbilt has not yet said when normal access to university systems will resume or whether it plans to notify affected individuals directly.