Vanderbilt cyberattack: what we know

By Midstate Daily News Desk · Edited by Channing Webb · Nov. 10, 2026

Kirkland Hall and its clock tower on the Vanderbilt University campus in Nashville, framed by fall trees (file photo, October 2023) — File photo of Kirkland Hall: Jaydenwithay via Wikimedia Commons, CC BY 4.0 (source)

TLDRVanderbilt University is running on a normal schedule Tuesday, Nov. 10, a day after a cyberattack forced it to tell students and staff to shut down university devices and get off campus Wi-Fi. Wi-Fi is back, but access to most Vanderbilt systems and apps is still restricted. A ransomware group called BYOD has claimed responsibility and says it stole student and employee data; Vanderbilt has not confirmed any data was taken. Vanderbilt Health hospitals and clinics say they were not affected. The university promised its next update by 9 a.m. Tuesday.

Vanderbilt University students and staff head into Tuesday with classes on but much of the school's digital world still locked down after a cyberattack Monday.

The university said Monday evening that campus Wi-Fi is available again, but "access to most Vanderbilt systems and applications remains restricted." Vanderbilt Information Technology is working with government agencies and other partners on the response, the school said.

What happened Monday

Some students and employees opened their laptops Monday morning to a message that read, "You have been compromised by BYOD," WSMV reported. The note told users to follow instructions left on their desktop and warned that "failure to communicate will result in this estate being brought to the ground completely."

One employee told the Nashville Banner that her computer showed a "system update" notice, then a message that it was deleting old files, then a ransomware warning. After that, she said, all of her files had been renamed with a ".byod" extension.

At 10:45 a.m., Vanderbilt posted that it was responding to "an active cybersecurity incident that may impact university devices, systems, and cloud-based services." It asked everyone to shut down university devices, disconnect from university Wi-Fi and stay alert for suspicious activity.

Who claims responsibility

The BYOD ransomware group claimed the attack on its data leak site, according to BleepingComputer. The group claims it locked Vanderbilt's databases and took more than 1 million Social Security numbers along with names, email addresses, phone numbers and student and employee records.

Those are the group's claims. Vanderbilt has not said what was accessed or whether any personal information was stolen, and FOX 17 News said it had not independently verified the claims.

Is class still on?

Yes. Vanderbilt said it would operate on a normal schedule Tuesday, Nov. 10.

Students: Classes meet as scheduled. The university told students to contact instructors for guidance, including flexibility on coursework deadlines. Student services are open, and Student Care Network offices are taking appointments.

Faculty: Teach as scheduled. Researchers with grant submissions due this week can get help from the office of Vice Provost for Research and Innovation Susan Marguiles, the university said.

Staff: Report to work as scheduled.

Students told FOX 17 News they switched to phone hotspots and printed handouts Monday to keep up. "The vast majority of us are using our laptops every day in class," senior Luke Wells told WSMV.

What about Vanderbilt Health?

Vanderbilt Health runs on separate IT systems and said its hospitals and clinics had not been affected, according to WSMV and the Nashville Banner. Patient care is continuing, FOX 17 News reported, though the health system is taking precautions and told employees to stay off university IT systems until further notice.

What to watch for

Vanderbilt asked anyone who sees unexpected pop-ups, unfamiliar apps, renamed or missing files, odd changes in OneDrive or Box, or surprise requests for passwords or sign-in approvals to stop. Do not click anything or try to fix it. Shut the device down and call the IT service desk from a different device.

Attacks like this often bring follow-up scam emails and texts that pretend to be from the school or IT staff. Treat any unexpected request for a password, a login code or a payment with suspicion, and check it through official Vanderbilt channels first.

If Vanderbilt later confirms that personal information was taken, the Federal Trade Commission's IdentityTheft.gov site lists steps for data breach victims, including free credit freezes at Equifax, Experian and TransUnion.

What happens next

Vanderbilt said it would post its next update by 9 a.m. Tuesday, including the status of systems and apps. The university is posting updates on its news site and social media accounts.

For more campus news, see our Vanderbilt football story and all Davidson County news.