{"id":"CMP-202611-76qc57","kind":"campaign","aliases":[],"related":[],"title":"Vanderbilt University hit by BYOD ransomware: gang claims encrypted databases and stolen student, employee and research data","description":null,"summary":"Vanderbilt University (Nashville) confirmed on 9 Nov 2026 an active cybersecurity incident that may affect university devices, and told users to shut down devices and disconnect from university Wi-Fi. The BYOD ransomware gang (new in 2026, also claimed University of New Mexico Health Sciences Center last month) claims on its leak site to have encrypted the university's databases and stolen its 'entire estate and research data', including over one million SSNs, names, emails, phone numbers, work addresses, roles and birthdays of students and employees. A ransom note README_BYOD_31.txt was seen on a Vanderbilt computer. Vanderbilt has not confirmed data theft, encryption or BYOD's involvement; data claims are unverified. Expect phishing and identity-fraud attempts against Vanderbilt students, staff and alumni.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T00:34:42+00:00","products":[{"name":"Vanderbilt University","fixed":[],"vendor":"Vanderbilt University"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Ransom note file README_BYOD_31.txt on devices; infected machines playing audio saying the network was compromised by 'BYOD'; ransom note pointing to the BYOD leak site and a Session messenger contact. Per Vanderbilt: unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage, missing or modified files, unfamiliar applications, unexpected authentication requests. For people: treat emails, calls or texts referencing Vanderbilt records or SSNs with suspicion.","fix":"Vanderbilt users: shut down university devices, disconnect from university Wi-Fi, do not troubleshoot yourself, contact the Vanderbilt IT service desk. Students and staff: watch for phishing, consider a credit freeze and monitor for SSN misuse. Organisations sharing accounts, integrations or data with Vanderbilt: rotate shared credentials and watch for suspicious access.","status":"open","published_at":null,"first_seen_at":"2026-11-10T00:34:42+00:00","triaged_at":"2026-11-10T00:34:42+00:00","updated_at":"2026-11-10T00:35:51+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-10T00:36:54Z","path":"phishing","entry":"unknown","reason":"The record says Vanderbilt has not disclosed how the attacker got in, and that users should expect phishing and identity-fraud attempts against students, staff and alumni, so the path is phishing while the entry is not stated.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':19A '-76':20A '2026':35B,65B '9':33B 'activ':37B 'address':107B 'affect':42B 'also':66B 'alumni':152B 'attempt':146B 'birthday':110B 'byod':5A,60B,133B 'campaign':24B 'center':74B 'claim':8A,67B,77B,137B 'cmp':18A 'comput':124B 'confirm':31B,128B 'cybersecur':38B 'data':17A,96B,129B,136B 'databas':10A,88B 'devic':44B,51B 'disconnect':53B 'earli':26B 'early-warn':25B 'email':103B 'employe':14A,114B 'encrypt':9A,84B,131B 'entir':92B 'estat':93B 'expect':140B 'fi':58B 'fraud':145B 'gang':7A,62B 'health':72B 'hit':3A 'ident':144B 'identity-fraud':143B 'incid':39B 'includ':97B 'involv':135B 'last':75B 'leak':80B 'may':41B 'mexico':71B 'million':100B 'month':76B 'name':102B 'nashvill':30B 'new':63B,70B 'note':117B 'nov':34B 'number':105B 'one':99B 'phish':141B 'phone':104B 'qc57':21A 'ransom':116B 'ransomwar':6A,61B 'readme_byod_31.txt':118B 'research':16A,95B 'role':108B 'scienc':73B 'seen':120B 'shut':49B 'site':81B 'ssns':101B 'staff':150B 'stolen':12A,90B 'student':13A,112B,149B 'theft':130B 'told':46B 'univers':2A,29B,43B,55B,68B,86B 'university':23A 'unverifi':139B 'user':47B 'vanderbilt':1A,22A,28B,123B,125B,148B 'warn':27B 'wi':57B 'wi-fi':56B 'work':106B","nicknames":["BYOD ransomware"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["byodransomware","university","vanderbiltuniversity"],"ptokens":["university","vanderbilt"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"malware","search_a":"'-202611':19A '-76':20A 'byod':5A 'claim':8A 'cmp':18A 'data':17A 'databas':10A 'employe':14A 'encrypt':9A 'gang':7A 'hit':3A 'qc57':21A 'ransomwar':6A 'research':16A 'stolen':12A 'student':13A 'univers':2A 'university':23A 'vanderbilt':1A,22A","search_b":"'2026':35B,65B '9':33B 'activ':37B 'address':107B 'affect':42B 'also':66B 'alumni':152B 'attempt':146B 'birthday':110B 'byod':60B,133B 'campaign':24B 'center':74B 'claim':67B,77B,137B 'comput':124B 'confirm':31B,128B 'cybersecur':38B 'data':96B,129B,136B 'databas':88B 'devic':44B,51B 'disconnect':53B 'earli':26B 'early-warn':25B 'email':103B 'employe':114B 'encrypt':84B,131B 'entir':92B 'estat':93B 'expect':140B 'fi':58B 'fraud':145B 'gang':62B 'health':72B 'ident':144B 'identity-fraud':143B 'incid':39B 'includ':97B 'involv':135B 'last':75B 'leak':80B 'may':41B 'mexico':71B 'million':100B 'month':76B 'name':102B 'nashvill':30B 'new':63B,70B 'note':117B 'nov':34B 'number':105B 'one':99B 'phish':141B 'phone':104B 'ransom':116B 'ransomwar':61B 'readme_byod_31.txt':118B 'research':95B 'role':108B 'scienc':73B 'seen':120B 'shut':49B 'site':81B 'ssns':101B 'staff':150B 'stolen':90B 'student':112B,149B 'theft':130B 'told':46B 'univers':29B,43B,55B,68B,86B 'unverifi':139B 'user':47B 'vanderbilt':28B,123B,125B,148B 'warn':27B 'wi':57B 'wi-fi':56B 'work':106B","search_c":"","cause_entry":"unknown","cause_path":"phishing","disclosures_checked_at":null,"first_public_at":"2026-11-09T23:52:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-76qc57","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T00:34:42+00:00","fetched_at":"2026-11-10T00:34:42+00:00","note":null}],"documents":[{"id":111421,"url":"https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/","title":"BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed","kind":"blog","source":"blog","publisher":null,"text":"Vanderbilt University hit in BYOD ransomware attack, data theft claimed\n\nVanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...]","published_at":"2026-11-09T23:52:12+00:00","relation":"describes","confidence":null,"note":null},{"id":111317,"url":"https://x.com/BleepinComputer/status/2119941217496559869","title":"@BleepinComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed\nhttps://","kind":"post","source":"x","publisher":null,"text":"Vanderbilt University hit in BYOD ransomware attack, data theft claimed\nhttps://t.co/2rgonPnLSn\n\nhttps://t.co/2rgonPnLSn\n\nlikes 20 reposts 5","published_at":"2026-11-09T23:52:27+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}