Vanderbilt University in Nashville, Tennessee, is responding to an active cybersecurity incident, after the BYOD ransomware gang claimed it had encrypted the university's databases and stolen sensitive data belonging to students and employees.

The university confirmed the incident on Monday, 9 November 2026, warning that university devices, systems and cloud-based services may be affected. It told students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for suspicious activity.

"We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services. Our Information Technology team is actively investigating and working to contain the situation," Vanderbilt said in a statement posted on X.

What the gang claims

On the same day, the BYOD group claimed responsibility for the attack on its data leak site, alleging that it had encrypted Vanderbilt's databases and stolen student, employee and research data.

The leak-site post claims the gang holds "Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records" and boasts of a "Full takeover of your DC", referring to the university's domain controller. The message says: "We have your entire estate and research data."

BleepingComputer reported that it had received a photograph of an alleged computer screen showing icons associated with Vanderbilt University and a BYOD ransom note named "README_BYOD_31.txt". The note includes a link to the BYOD data leak site and contact details for the SESSION encrypted messaging platform, and BleepingComputer confirmed the link leads to the site operated by BYOD.

The ransom note reads: "Oh no, you have been compromised by BYOD. We have all of your data including your backups, your entire network is compromised." It adds that the attack "affects your student and employee data the most, every single SSN is archived", and threatens to release stolen data and cause further disruption if the university does not negotiate.

Claim not confirmed by the university

A video shared on YouTube and with BleepingComputer also shows infected devices playing audio warning that the network has been compromised by "BYOD". But while the ransom note and video point to BYOD, Vanderbilt has not officially confirmed the group's involvement, and has not confirmed whether any devices were encrypted or any data was stolen.

The university warned that signs of compromise may include unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage platforms, missing or modified files, unfamiliar applications and unexpected authentication requests. Anyone noticing suspicious activity was told not to investigate it themselves, but to shut down their device immediately and contact the university's IT service desk.

A new gang with a growing list

BYOD is a relatively new ransomware operation that launched in 2026 and currently lists five other organisations on its data leak site. Last month it claimed responsibility for an attack on the University of New Mexico Health Sciences Center that caused system outages and disrupted patient care and academic activities.

As with all leak-site claims, the Vanderbilt figures should be treated with caution until the university confirms what happened. The confirmed facts so far are that Vanderbilt is dealing with an active cybersecurity incident, and that a ransomware group has publicly claimed it. The university has not yet said how the attackers got in, how much data was affected, or when normal services will resume.