BYOD ransomware gang claims full takeover of Vanderbilt University network

A ransomware gang calling itself BYOD claims it has encrypted Vanderbilt University's databases and holds more than 1 million Social Security numbers, along with full names, email addresses, phone numbers and student and employee records. Vanderbilt confirmed an "active cybersecurity incident" on Monday but has not verified the gang's claims or said whether any data left its network.

The university disclosed the breach in a statement on X: "We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services. Our Information Technology team is actively investigating and working to contain the situation."

Instructing users to switch off their machines is an unusual move, and it tells you something about the suspected depth of the compromise.

What were students and staff told to do?

Vanderbilt ordered students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for signs of compromise. The listed indicators include:

• Unexpected pop-ups or security notifications
• Unusual changes to files or permissions in cloud storage
• Missing or modified files
• Unfamiliar applications
• Unexpected authentication requests

Anyone spotting these signs was told not to investigate or troubleshoot on their own. The instruction is blunt: shut the device down immediately and call the IT service desk. For an institution of Vanderbilt's size, that is effectively a campus-wide freeze on endpoint activity.

What does BYOD actually claim to hold?

The gang, which launched in 2026 and lists five other victim organizations on its data leak site, posted its claim Monday. "If you could not tell already, your databases are locked. We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess," the leak site reads.

BleepingComputer received a photograph of an allegedly infected screen showing Vanderbilt-associated icons and a ransom note named README_BYOD_31.txt. The outlet confirmed the link inside the note leads to the site BYOD operates. The note's tone is less than professional. "Oh no, you have been compromised by BYOD :<," it opens, before getting to business: "We have all of your data including your backups, your entire network is compromised."

The note goes on: "Yes, this affects your student and employee data the most, every single SSN is archived, full names, email addresses, phone numbers, work addresses, roles, birthdays, quite literally everything." It threatens to publish the stolen data and cause further disruption if the university declines to negotiate. Negotiation, incidentally, runs through the Session encrypted messaging platform, with contact details supplied in the note.

A video shared on YouTube and with BleepingComputer shows infected devices playing audio warnings that the network has been compromised by BYOD. Theatrical, certainly. Also consistent with an encrypt-and-extort operation that wants attention.

What does this change for security teams?

Vanderbilt has not confirmed the attack vector, whether systems were encrypted, what data may have been stolen or whether the incident is contained. BleepingComputer says it asked the university all of those questions directly; no answers have arrived. The gap between the university's careful "may impact" phrasing and the gang's claim of total domain-controller takeover is wide, and only the investigation will close it.

The context is not reassuring. BYOD claimed an attack on the University of New Mexico Health Sciences Center last month, an incident that caused system outages and disrupted both patient care and academic activities. A gang that has already touched a health system moving on to a private research university suggests a deliberate focus on institutions with valuable records and limited tolerance for downtime.

For CIOs and CISOs elsewhere, the practical lesson sits in Vanderbilt's response playbook: detect, contain, disconnect the endpoints, and route everything through one service desk. Whether the backups survived — the ransom note claims they did not — will determine how long that playbook has to run.