Vanderbilt University’s students and employees can power university devices back on. What attackers may have taken remains unresolved.
The Nashville university disclosed a cyberattack Nov. 9. Ransomware group BYOD claims it stole more than 1 million Social Security numbers, along with student, employee, and research data. Vanderbilt has not publicly confirmed the alleged theft, the figure, or the group’s involvement.
The immediate challenge is restoring access while investigating the intrusion. For people whose information may be involved, the uncertainty also makes it important to distinguish official instructions from attackers’ claims.
Campus access returns in stages
Vanderbilt initially asked its community to shut down university devices and disconnect from campus Wi-Fi. Its 9 a.m. Nov. 10 update allowed students, faculty, and staff to resume using university devices and listed these services as available:
- Campus Wi-Fi.
- Okta authentication, with continued use of multifactor authentication.
- Vanderbilt email through Outlook.
- Brightspace, Zoom, and Your Enrollment Services.
As of the university’s Nov. 10 morning update, all other Vanderbilt systems and applications remained restricted, including CampusPrint. The university said its IT team was working with government agencies and other partners.
Vanderbilt said its containment and response efforts had also constrained standard communications.
Gary Barlet, public sector CTO at Illumio, said the disruption illustrates why operational continuity must be part of universities’ security planning.
“Universities can’t assume they’ll prevent every intrusion. They need to make sure that when something is compromised, they can isolate it quickly and keep the rest of the institution running,” Barlet said.
For security teams, recovery notices should identify which services are approved for use and which restrictions still apply. A working Wi-Fi connection alone cannot answer those questions.
The million-SSN figure is an attacker claim
BleepingComputer reported that BYOD listed Vanderbilt on its leak site, claiming to have encrypted databases and obtained names, email addresses, phone numbers, Social Security numbers, and research information.
The outlet also received a photograph of an apparent Vanderbilt computer displaying a BYOD ransom note, along with a video showing an audio warning on affected devices.
Those materials do not establish how much data was stolen. Vanderbilt has not publicly confirmed database encryption or BYOD’s claimed access to the university’s domain controller. The alleged SSN count should not be treated as a verified number of affected people.
The investigation must answer separate questions: which systems attackers accessed, whether information left those systems, and whose records were involved.
That distinction also matters during ransomware recovery. Restoring applications addresses availability; investigating unauthorized access and potential data theft requires additional evidence.
“If Social Security numbers were stolen, restoring servers will not undo that exposure,” said Darin Fredde, senior director and offensive security evangelist at Ridge Security.
What campus users should do now
Vanderbilt’s guidance identifies unexpected authentication requests, unfamiliar prompts, and unexplained changes to files or cloud-storage permissions as warning signs. Anyone seeing suspicious activity should shut down the affected device immediately, avoid clicking prompts or investigating independently, and contact IT from a separate device or telephone.
Users should also:
- Verify recovery instructions independently. Open a known university website or use an established IT contact before following an unexpected request to reset credentials or install software.
- Reject unfamiliar authentication requests. Report prompts you did not initiate. Attacks that target session tokens and authentication workflows show why a familiar login service does not make every request trustworthy.
- Consider identity protection without assuming exposure. The Federal Trade Commission explains that a free credit freeze can help prevent new-account identity theft, and people do not need to wait for a confirmed breach to request one. Contact Equifax, Experian, and TransUnion separately.
What security teams should verify before widening access
For other institutions reviewing their response plans, Vanderbilt’s disruption offers a concrete exercise: could staff find authoritative instructions if their normal communications tools were restricted?
Security leaders should test that scenario alongside technical recovery. Establish a publicly reachable update channel, identify who approves service restoration, and explain how users should report suspicious behavior without relying on an affected device.
Roy Katmor, co-founder and CEO of Orchid Security, pointed to the importance of understanding what a compromised identity could access.
“We don’t yet know how the attackers got in, but the bigger question is how far they could reach,” Katmor said. “The real risk is the gap between who should have access and what their identities can actually reach.”
For institutions assessing that risk, review what student, employee, service, and administrator accounts can actually reach. Identify excessive privileges and dependencies that could let one compromised account expose additional systems.
Investigators should also examine identity systems, privileged access, cloud activity, and backup integrity according to the evidence. Separate GlobalProtect ransomware investigations have shown attackers reaching virtualization and backup infrastructure. That is a reason to test those defenses, not evidence of Vanderbilt’s entry point.
Fredde recommended a recurring cycle of offensive testing, remediation, and retesting to verify that usable attack paths have been closed. He also cautioned that recovery requires checking for ways an attacker could return; Vanderbilt’s intrusion path and testing arrangements remain unknown.
“Getting systems back online is progress. Establishing that the attacker’s access has been removed is another part of the job,” Fredde said.
For Vanderbilt’s community, the next consequential update will be one that clarifies the scope of unauthorized access and any confirmed data exposure. Until then, follow current service-specific guidance, report unexplained activity, and assess any eventual breach notice against the actual information it says was involved.
Read more: How attackers use passkey-themed phishing to breach Microsoft 365 accounts explains why unexpected requests to update authentication settings deserve scrutiny during incident recovery.