Vanderbilt University confirmed an active cybersecurity incident on 9 November 2026 and told its community to shut down devices and disconnect from campus WiFi. Separately, a ransomware-leak-site listing under the name BYOD claims to hold more than a million Social Security numbers from the university. The table below keeps these two pictures apart: what Vanderbilt itself has said, and what only the leak-site listing claims.
| Point | Vanderbilt's own statement | BYOD leak-site listing |
|---|---|---|
| An incident is happening | Confirmed: active incident reported 9 Nov 2026; IT is investigating and containing it | Claimed: BYOD lists “Vanderbilt EDU” as a victim, posted 9 Nov 2026 |
| What is affected | Confirmed: university devices, systems and cloud services, including OneDrive and Box, may be impacted | Claimed: the “entire estate and research data,” a full takeover of the domain controller |
| Data said to be taken | Not stated by Vanderbilt | Claimed: over 1 million Social Security numbers, names, emails, phone numbers, student and employee records |
| Who is behind it | Not named by Vanderbilt | Claimed: the group behind the BYOD-branded listing |
| Current status | Active investigation and containment; one statement published so far | Claimed only; not disputed, removed or confirmed as of 10 Nov 2026 |
The left column is only what Vanderbilt itself has published. The right column is only what the BYOD leak-site listing says, with its own wording kept as a claim. A claim on a leak site is not proof that the listed data was taken.
What the Vanderbilt Cyberattack Statement Confirms
Vanderbilt posted its statement on 9 November 2026 at 11:19 a.m. It said it is “currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services.” It added that its IT team is “actively investigating and working to contain the situation.”
- Shut down university devicesDisconnect from university WiFi and remain vigilant for unusual activity.
- Watch for the listed signsUnexpected pop-ups, unusual changes in OneDrive or Box, files moved or renamed without you, unfamiliar apps, or surprise password and MFA prompts.
- Do not click or self-troubleshootLinks, pop-ups, attachments and unfamiliar prompts stay unclicked; do not try to fix a suspicious device yourself.
- Shut the device down and call the IT Service DeskReport it immediately, from a separate device or phone.
What the BYOD Leak-Site Listing Claims
A ransomware-leak-site listing tracked by ransomware.live names “Vanderbilt EDU” as a victim of a group using the name BYOD. The listing was posted on 9 November 2026, the same day Vanderbilt published its statement.
The listing claims the group holds Vanderbilt’s “entire estate and research data.” It lists more than a million Social Security numbers, full names, email addresses, phone numbers, and student and employee records. It also claims a “full takeover” of what it calls Vanderbilt’s domain controller, the server that manages logins across a Windows network. These are the group’s own words, copied from the listing, not a finding we or Vanderbilt have verified.
Brandefense Blackhole recorded 33 mentions of Vanderbilt in monitored cybercrime channels between 12 August and 10 November 2026, a window that covers the days around this listing. The count does not show what any of those mentions say, and it is not proof the claim is accurate.
Why the Two Pictures Differ
Ransomware groups post victims to leak sites to pressure them into paying. The claim is written by the group trying to extort the victim, and no outside party checks it before it is posted. That is why we treat a leak-site claim as a claim, not as evidence a breach happened, until the named organization or an independent investigator confirms it.
Our guide to responding to a leak-site listing covers this pattern in more detail. Our review of dark-web breach trends in the education sector shows the pattern is not new to higher education.
What To Do Now
If you are part of the Vanderbilt community, follow the university’s own instructions above and report through the IT Service Desk, not email or chat. If you are watching from another organization, we recommend treating any unexpected login or MFA prompt as hostile until your own IT team confirms otherwise. We also recommend keeping personal devices off managed WiFi during any active, unexplained incident at your own institution.
Frequently Asked Questions
Has Vanderbilt confirmed a ransomware attack?
No. Vanderbilt's own statement calls it an active cybersecurity incident and does not use the word ransomware, name an attacker, or say data was taken.
What does the BYOD leak-site listing claim?
It claims to hold Vanderbilt's entire estate and research data, including more than a million Social Security numbers, and a full takeover of the domain controller. This is the group's own wording and is not independently confirmed.
What should I do if I am a student or employee at Vanderbilt?
Follow Vanderbilt's own guidance: shut down your device, disconnect from campus WiFi, and do not click unfamiliar links or prompts. Report anything suspicious to the IT Service Desk from a separate device or phone.
Does a leak-site listing prove a breach happened?
No. The listing is written by the group trying to extort the victim and is not checked by anyone outside the listing before it is posted. Treat it as a claim until Vanderbilt or an independent source confirms it.
