BYOD ransomware gang targets Vanderbilt University and claims theft of sensitive campus data

Vanderbilt University announced on Monday that it was responding to an active cybersecurity incident affecting university devices, systems, and cloud-based services. The Nashville institution initially instructed students and staff to shut down university-owned machines and disconnect from the campus Wi-Fi network, though campus Wi-Fi was restored by Monday evening. The extortion gang BYOD claimed responsibility on its data leak site, alleging that it locked databases and stole over 1 million Social Security numbers alongside employee, student, and research records. Vanderbilt has not confirmed BYOD's claims or verified whether any data was taken. [1][2]

During the incident, campus computers reportedly broadcast an audio message stating, "You have been compromised by BYOD," and warned users to follow desktop instructions or face complete destruction of the system estate. A ransom note titled "README_BYOD_31.txt" directed victims to the encrypted messaging platform SESSION to negotiate, while threatening to release backups and personal data. Vanderbilt told students that classes would proceed as scheduled on Tuesday and instructed staff to report to work normally, but access to most systems remained restricted. The disruption also took down the athletics ticketing platform, preventing students from claiming tickets for Saturday's football game against Alabama. [1][2]

Vanderbilt Information Technology stated that it is collaborating with government agencies and other partners to handle the breach. BYOD, a relatively new ransomware operation that launched in 2026 and lists five other organizations on its leak site, previously claimed responsibility for cyberattacks against the University of New Mexico and Trump Mobile's customer database. [1][2]