BYOB Ransomware Claims Access to 1 Million Vanderbilt Records

Vanderbilt University is managing an active cybersecurity incident after the ransomware group BYOB claimed responsibility for the breach. The group states it gained access to more than one million Social Security numbers, along with full names and email addresses, within the university's network. Officials at the school announced the incident on Thursday morning.

The university's Information Technology department is leading the investigation into the compromise. As a precaution, IT directed students and faculty to power down university-issued devices and disable their Wi-Fi connections. The administration indicated that cloud-based services could also be affected by the intrusion.

Aminat Rosenje, a junior from Chicago, described the disruption to her daily routine. She learned of the attack during a class when an IT staff member entered the room. "I found out while I was in class. In the middle of it, one of the IT members came in and told us to disconnect from the Wi-Fi and to not open any emails or click any links because we were under a cybersecurity attack," Rosenje said. She has since relied on personal hotspots to maintain an internet connection.

BYOB posted a message on its live website asserting that the university's databases are locked. The group stated, "If you could not tell already, your databases are locked. You know where to find us (contact tab). We will take you down when communication has been established between our team and yours." The student-led newspaper The Vanderbilt Hustler shared a link to this site.

IT staff advised the campus community to report specific signs of compromise. These include unusual requests for passwords, files that move without user input, unfamiliar messages, or unexpected pop-ups. One student reported receiving a laptop message from the group claiming they had all of the user's data. The note warned the student not to fight the intrusion, adding, "We’ve done our research on you." It suggested reaching out to make a decision off the grid to make everyone's lives easier.

An update issued Monday evening confirmed that campus Wi-Fi is back online. However, access to most Vanderbilt systems and applications remains restricted. The IT team is coordinating with government agencies to manage the response. Classes were expected to continue normally, though some faculty canceled sessions according to The Vanderbilt Hustler. The university is scheduled to operate on a normal schedule on Tuesday, Nov. 10, with students directed to contact instructors regarding deadline flexibility.

Spokesperson Julia Jordan stated that classes are expected to proceed as planned. The university instructed users to avoid clicking unfamiliar prompts or attempting to troubleshoot issues independently. Instead, users should contact the IT service desk via a separate device or telephone to report any incidents.