Vanderbilt University asked its community to shut down university devices and disconnect from campus Wi-Fi Monday as it worked to contain a cybersecurity incident.
The private research university in Nashville, Tennessee, reports fall enrollment of 13,813 students.
“We are currently responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services,” Vanderbilt said in its Monday notice.
Anyone noticing suspicious activity was told to shut down the device, avoid trying to fix it and contact the IT service desk from a separate device or telephone.
The notice did not identify specific unavailable applications or announce class cancellations. Its examples of suspicious file changes and unexpected login requests were warning signs to report, rather than confirmed findings of encryption or stolen credentials.
Vanderbilt Health, a legally and financially separate organization, told WSMV that its IT systems had not been affected. “Patient care is continuing at all our hospital and clinical locations,” the health system said.
In a claim reviewed by DysruptionHub, the cybercrime group BYOD said Vanderbilt’s databases were locked and claimed to hold research data, student and employee records, and more than 1 million Social Security numbers.
“We have your entire estate and research data,” the group wrote in a post naming Vanderbilt EDU. Vanderbilt has not attributed the incident to BYOD or confirmed encryption or data theft.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
BYOD also claimed responsibility for an October incident at the University of New Mexico, where a cyberattack forced ambulance diversions and canceled clinic appointments. UNM had not confirmed BYOD’s involvement when DysruptionHub reported the disruption Oct. 27.
Vanderbilt’s IT status page warned that it was being rebuilt and its information should not be treated as accurate, despite displaying green service indicators. The page therefore could not establish whether normal access had returned.
The university had not provided a timetable for resuming normal device and network use.
