In this article
- Vanderbilt is bringing campus systems back online after a cyberattack
- BYOD claims it stole sensitive data, but Vanderbilt has not confirmed those claims
- Students and staff should follow official guidance and watch for suspicious messages
- Eligible students can get Malwarebytes for free through our Student Protection Program
Vanderbilt University is bringing systems back online after a cybersecurity incident claimed by the BYOD ransomware group.
Vanderbilt University is a private research university in Nashville, Tennessee. Founded in 1873, it now serves more than 13,800 undergraduate, graduate, and professional students across 12 schools and colleges, with programs ranging from engineering and education to law, medicine, and nursing. Its combination of teaching and research means its systems support not only everyday campus activities but also valuable academic research.
According to Bleeping Computer, BYOD claims it encrypted Vanderbilt’s databases and obtained more than one million Social Security numbers, along with names, email addresses, telephone numbers, student and employee records, and research data. It also claims control of a domain controller (a server that manages network access) and possession of backups.
How the attackers gained access remains undisclosed. Vanderbilt’s November 10 evening incident update states that the following systems and applications are available:
- Campus Wi-Fi
- Okta: Continue to use multifactor authentication (MFA)
- Vanderbilt email (Outlook): Vanderbilt email is available on Vanderbilt and personal devices
- CampusPrint
- Brightspace
- Zoom
- YES (Your Enrollment Services): All course registration is proceeding as scheduled
Other Vanderbilt systems and applications remained restricted. The university says fully restoring normal operations could take several weeks.
The university has not confirmed the number of affected people. BYOD claims it obtained more than one million Social Security numbers, but that is not a verified count of affected students or other people. The university says it is still determining what data, if any, was accessed.
How to stay safe
BYOD has threatened to release the data it claims to have stolen.
Students and staff should follow Vanderbilt’s latest IT guidance and be alert to messages asking them to restore access, disclose passwords, or approve unexpected login requests.
We have a guide for people who discover their data was included in a data breach: Involved in a data breach? Here’s what you need to know.
How Malwarebytes can help
Protection for personal devices can help reduce the risk of follow-on malware and scams, but it cannot undo the theft of information from a university’s systems.
Vanderbilt students can get free Premium Security for two years on up to three devices through our Malwarebytes Student Protection Program. This can help protect against malware and scams, including those that could follow any release of stolen data.
Malwarebytes Scam Guard is a free tool that can help you assess whether a message is a scam and suggest what to do next.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
