Research

Vanderbilt Is Responding to a Cyber Incident and a Ransomware Gang Called BYOD Claims It. The Claim Is Unconfirmed. Here Is What Is Known About the Gang, and What a University Should Check Now

Patrick Duggan · · 3 min read

Vanderbilt Is Responding to a Cyber Incident and a Ransomware Gang Called BYOD Claims It. The Claim Is Unconfirmed. Here Is What Is Known About the Gang, and What a University Should Check Now
Facts for the Vanderbilt incident of November 9, 2026. Vanderbilt is responding to a cyber incident and a ransomware group called BYOD claims it, with unverified claims of over one million records. Vanderbilt has confirmed nothing about the attack type or data theft. Check you can cut sign-ins and device access quickly and keep offline backups.

If you run IT for a university or a hospital system, this is a good day to check how you would shut down devices and cloud sign-ins in a hurry. On Monday, November 9, 2026, Vanderbilt University said it was "responding to an active cybersecurity incident that may impact university devices, systems, and cloud-based services." The same day a ransomware group that calls itself BYOD claimed the attack on its leak site. Vanderbilt has not confirmed the group's involvement, has not said what kind of attack it is, and has not said whether data was stolen.

What has been reported

The source is BleepingComputer's report of November 9, which quotes Vanderbilt's statement on X. We did not read the statement directly.

  • Vanderbilt's instructions: students, faculty and staff were told to shut down university devices, disconnect from university Wi-Fi and watch for suspicious activity. Signs it lists: unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar apps and unexpected authentication requests. People who see problems are told to shut the device down and contact the IT service desk rather than troubleshoot.
  • The claim: BYOD, a group that launched in 2026, says on its leak site that it encrypted Vanderbilt's databases and stole sensitive data. In the group's words: "your databases are locked, We have your entire estate and research data." It claims more than one million Social Security numbers plus names, emails, phone numbers and student and employee records. These claims are unverified.
  • What BleepingComputer saw: a photo of an alleged infected screen showing a ransom note named README_BYOD_31.txt, and a video in which infected devices play audio saying the network was compromised by "BYOD." Whether that is how Vanderbilt's own devices behaved is not confirmed.
  • The negotiation channel: the note says the group has backups, that the network is compromised, and that stolen data will be released and disruption continued if the university does not negotiate. Negotiation is to run through the SESSION messaging app.
  • The group: BleepingComputer says it lists five other organizations on its leak site and, last month, claimed an attack on the University of New Mexico Health Sciences Center that caused outages and disrupted patient care. In this context "BYOD" is the group's name, not the "bring your own device" policy. The report does not say where the name comes from.

What to do

  1. If you are a Vanderbilt student, employee or alum, do not act on a message about the incident that you did not initiate. Use the university's own channels, watch for fake "your data was stolen" emails, and be alert for credit monitoring offers that did not come from the university.
  2. If you run a university or health system, find out now whether you can cut sign-ins and device network access in minutes. Vanderbilt's instruction to power down devices and leave the Wi-Fi is the manual version of that.
  3. Hunt for the note name README_BYOD_31.txt on file servers and endpoints. This is one outlet's description of a photo, so treat a hit as a reason to look, and a miss as meaning nothing; ransomware gangs change note names.
  4. Check what an attacker could reach through cloud sign-ins and file sharing, since Vanderbilt's warning included changes to cloud files and permissions. Review recent changes to permissions and unusual authentication prompts.
  5. Make sure backups are offline or immutable and have been test-restored. The note claims the group holds backups, which is a statement about the attacker's access and not evidence of a technique.
  6. Do not rely on the group's claims: a leak-site post may be exaggerated or false.

What is not known

What happened to Vanderbilt's systems; whether the group is behind it; whether any data was stolen and what; how the group gets in; and who it is. The sources give no indicators beyond the note's file name, so we ingest nothing into our feed.

How we know, and how we checked

We read BleepingComputer's report, which includes the Vanderbilt statement and the group's leak-site claims. We did not visit the leak site and did not examine any sample. Our corpus search found no earlier post of ours on this group.

Sources

BleepingComputer, "Vanderbilt University hit in BYOD ransomware attack, data theft claimed," Lawrence Abrams, November 9, 2026. As cited there and not opened by us: Vanderbilt University statement on X, November 9, 2026.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register