BYOD Ransomware Group Claims Vanderbilt University Breach
Vanderbilt ordered staff to disconnect devices after an incident affected systems and cloud services, though clinical operations remained intact.
By Marco Whitaker ·
Vanderbilt University instructed all faculty and staff to power down university devices and disconnect from campus Wi-Fi on Monday morning. The university is investigating an active cybersecurity incident that could impact on-premise systems and cloud-based services.
The school confirmed the apparent cyberattack in a social media statement. It urged personnel to remain extremely vigilant while officials worked to contain the threat. A Vanderbilt Health spokesperson stated that hospital and clinical facilities were not impacted by the event. The health system said it was proceeding with utmost care and diligence during the investigation.
An employee described seeing a system update notification on her computer when she started it up on Thursday. That alert was followed by a message indicating the machine was deleting old files. A warning about a ransomware attack then appeared with a link for more information. The employee said all files on the computer subsequently became .byod files.
Another source, who was not authorized to speak on the record, reported that the IT help line for Vanderbilt employees had crashed during the incident.
Messages attributed to the ransomware group BYOD appeared online Monday. The group claimed responsibility for the Vanderbilt breach. BYOD has also recently claimed attacks on Michigan State University and the University of New Mexico Health System.
Vanderbilt continues to monitor the situation. The university said it will provide further updates as the investigation progresses.
