---
id: "CMP-202611-76qc57"
page: "https://infrastack.ai/live/CMP-202611-76qc57"
kind: "campaign"
aliases: []
title: "Vanderbilt University hit by BYOD ransomware: gang claims encrypted databases and stolen student, employee and research data"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Vanderbilt University", "fixed": [], "vendor": "Vanderbilt University"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-10T00:34:42+00:00"
updated_at: "2026-11-10T00:35:51+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-10T00:34:42+00:00"}]
exploit_sources: []
---

# Vanderbilt University hit by BYOD ransomware: gang claims encrypted databases and stolen student, employee and research data

Link for people: https://infrastack.ai/live/CMP-202611-76qc57 (this .md is for agents)

Vanderbilt University (Nashville) confirmed on 9 Nov 2026 an active cybersecurity incident that may affect university devices, and told users to shut down devices and disconnect from university Wi-Fi. The BYOD ransomware gang (new in 2026, also claimed University of New Mexico Health Sciences Center last month) claims on its leak site to have encrypted the university's databases and stolen its 'entire estate and research data', including over one million SSNs, names, emails, phone numbers, work addresses, roles and birthdays of students and employees. A ransom note README_BYOD_31.txt was seen on a Vanderbilt computer. Vanderbilt has not confirmed data theft, encryption or BYOD's involvement; data claims are unverified. Expect phishing and identity-fraud attempts against Vanderbilt students, staff and alumni.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Vanderbilt University affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says Vanderbilt has not disclosed how the attacker got in, and that users should expect phishing and identity-fraud attempts against students, staff and alumni, so the path is phishing while the entry is not stated.

How it reached others: their users got messages abusing it (phishing).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#phishing

## How to check

Ransom note file README_BYOD_31.txt on devices; infected machines playing audio saying the network was compromised by 'BYOD'; ransom note pointing to the BYOD leak site and a Session messenger contact. Per Vanderbilt: unexpected pop-ups or security notifications, unusual changes to files or permissions in cloud storage, missing or modified files, unfamiliar applications, unexpected authentication requests. For people: treat emails, calls or texts referencing Vanderbilt records or SSNs with suspicion.

## Fix

Vanderbilt users: shut down university devices, disconnect from university Wi-Fi, do not troubleshoot yourself, contact the Vanderbilt IT service desk. Students and staff: watch for phishing, consider a credit freeze and monitor for SSN misuse. Organisations sharing accounts, integrations or data with Vanderbilt: rotate shared credentials and watch for suspicious access.

## Timeline

- 2026-11-10T00:34:42+00:00 analyst

## Documents

- [describes] BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/
- [describes] @BleepinComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed
https:// https://x.com/BleepinComputer/status/2119941217496559869

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_