Shut It Down, Unplug, Call IT: How Vanderbilt Responded as a New Ransomware Gang Claimed Its Network
Vanderbilt University told students and staff to shut down university devices and disconnect from campus Wi-Fi on Monday while it contains an active cybersecurity incident. The BYOD ransomware gang claims it encrypted databases and stole data; the university has not confirmed those claims.
On Monday morning, Vanderbilt University’s students, faculty and staff received an unusual instruction: turn your university device off, get off the campus Wi-Fi, and do not try to fix anything yourself. The Nashville school had detected an active cyberattack and was moving to contain it.
This account draws on BleepingComputer’s reporting on the Vanderbilt incident and coverage by The Record from Recorded Future News.
What the university told its community
In a statement posted on X, Vanderbilt said it was responding to an active incident that might affect university devices, systems and cloud-based services, and that its IT team was investigating and working on containment. Alongside the shutdown order, it gave people a list of warning signs to watch for: unexpected pop-ups or security alerts, odd changes to files or sharing permissions in cloud storage, files that had vanished or been altered, applications nobody installed, and sign-in prompts nobody requested. Anyone who saw those signs was told to power down and contact the IT service desk rather than investigate on their own. The university serves about 14,000 students and employs more than 6,000 staff, according to The Record.
The gang’s version
The same day, a ransomware group calling itself BYOD added Vanderbilt to its data leak site. It claims to have locked the university’s databases, taken control of its domain controller and stolen research data along with student and employee records, which it says include more than a million Social Security numbers. BleepingComputer received a photo of what appears to be a Vanderbilt computer showing a BYOD ransom note, and a video showing infected machines playing an audio message announcing the compromise. The note threatens to leak data unless the university negotiates.
Vanderbilt has not confirmed that BYOD is responsible, that devices were encrypted, or that any data was stolen. Every figure above is the attackers’ claim.
Who BYOD is
The group is new. Ransomware researcher Allan Liska told The Record its first known victim appeared on September 29. Since then it has been linked to attacks on Michigan State University and the University of New Mexico, where the incident reached medical facilities and forced a major hospital to turn away ambulances, and it is believed to be behind a Trump Mobile data leak. BleepingComputer says the leak site lists five other organizations. This is also not Vanderbilt’s first brush with ransomware: Vanderbilt University Medical Center was hit in 2023.
The bigger picture
The Record cites new industry data showing how crowded the field has become. Halcyon measured a 40% jump in ransomware activity between July and September, with 111 groups claiming 2,766 attacks in 122 countries. Trellix reported record numbers of groups and leak-site posts from April to September.
What this means for your company
Vanderbilt’s instructions are a useful template for any organization, because the first hour of a ransomware incident is mostly about stopping the spread. Decide now who has the authority to order devices shut down and the network disconnected, and how you would reach staff if email and chat were unavailable. Teach employees the same short list of warning signs and a single number to call. Behind that, the layers that limit damage are well known: multi-factor sign-in everywhere, tight control of administrator and domain controller accounts, endpoint detection and response with around-the-clock monitoring, and backups that are offline or immutable and have actually been restored in a test. Gangs like this one routinely claim to have your backups, so make sure that claim would be false.
Would your team know exactly what to do in the first hour of an attack like this? We can help you write and rehearse that plan. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
