Skip to content
securitytabs

LiveUpdated

Vanderbilt University responds to ransomware attack claimed by BYOD gang

Vanderbilt University says it is dealing with a cybersecurity incident, and a ransomware group called BYOD has claimed the attack. Classes are continuing, and some services are coming back online; no action is needed from the public.

Ransomware attack claimed against Vanderbilt University
Ransomware attack claimed against Vanderbilt University

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Vanderbilt University announced on Monday morning that it was dealing with an active cybersecurity incident that could affect university devices, systems and cloud-based services. The ransomware group BYOD has claimed the attack. [1][2]

BYOD claims it encrypted the university's databases and stole sensitive student, employee and research data. The university's own statements, as described in the coverage reviewed, do not confirm those claims. [2][1]

Impact and recovery

Classes were proceeding as scheduled on Tuesday, although access to most university systems remained restricted. CyberScoop reports that some services began returning online that day after the incident was detected on Monday. [1][3]

What is not yet known

The coverage reviewed does not say how the attackers got in, whether data was taken, how much, or whether a ransom was demanded. [2][1][3]

Timeline

  1. Vanderbilt kept classes running while some services began returning online. [1][3]

  2. The BYOD ransomware group claimed the attack and said it stole student, employee and research data. [2]

  3. Vanderbilt University said it was responding to a cyberattack on its systems. [2]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

The reported attack is on a single university; the coverage reviewed gives no technical details that apply to other organizations. [2][3]

What to do

  1. Confirm with any education or research partner that you share data with whether it has been affected. [1]
  2. Watch for notices from Vanderbilt if you are a student, employee or research partner. [2]

Mid-size company

A small IT or security team

What to know

BYOD claims to have both encrypted databases and stolen data, a double-extortion pattern; the university has not confirmed the claims in the coverage reviewed. [2][1]

What to do

  1. Check which data you share with Vanderbilt University and watch for its notices. [1]
  2. Confirm that backups and incident response contacts are current. [2]

Large enterprise

A security operations team

What to know

No indicators of compromise or initial access details have been published in the coverage reviewed. [2][1][3]

What to do

  1. Review third-party connections and data sharing with Vanderbilt University. [1]
  2. Monitor for further statements from the university or the BYOD group about stolen data. [2][3]

Sources

  1. [1]The Register Security · Nov 10, 13:00 UTC
    Ransomware threat blares from Vanderbilt University computers during cyberattackcontext
  2. [2]BleepingComputer · Nov 9, 23:52 UTC
    Vanderbilt University hit in BYOD ransomware attack, data theft claimedcontext
  3. [3]CyberScoop · Nov 10, 17:46 UTC
    Vanderbilt University reels following ransomware attack claimed by BYOD groupcontext