Vanderbilt University told students and staff to shut down school-issued devices and leave campus WiFi after a ransomware attack on November 9. The group claiming credit says it stole more than 1 million Social Security numbers. The university has not verified that. (Ransomware is malware that locks up files and demands payment.)
A professor was mid-class that day when about 40 files labeled "Read Me" appeared on her screen and a spoken message began to play. Vanderbilt hasn't said how its IT team first spotted the attack. A ransomware group calling itself BYOD posted a claim of responsibility: "We have your entire estate and research data." It also said it had taken student and employee records. A separate ransom note threatened to release the data unless Vanderbilt negotiated.
Recovery was uneven. WiFi was back by that evening, and the Brightspace course platform and the YES student portal were cleared for use. The file storage services OneDrive and Box were still affected. Classes kept their usual schedule on November 10, and students struggling to finish assignments were told to ask instructors about extensions. One person said they had lost access to research stored on Vanderbilt's systems and were relying on personal backups. The university said its IT team continues to work with government agencies and other partners.
This was not BYOD's first campus. On October 26, employees at the University of New Mexico Health Sciences Center heard a similar voice message over their work computers, and BYOD claimed that attack too. UNM Health diverted ambulances to other hospitals and temporarily suspended outpatient surgeries and appointments. UNM later said its investigation found the attack affected some staff and student devices but did not reach its core systems or servers.
That finding describes where the attack landed, not what, if anything, left the network. It does not settle whether BYOD's theft claims hold up at UNM, and it says little about Vanderbilt. For now, the 1 million figure is a claim in a ransom note. The open question is whether Vanderbilt can determine whose information was exposed, if anyone's.