Vanderbilt University in Nashville announced an “active cybersecurity incident” on Monday, November 9, saying it may affect university devices, systems and cloud-based services. Its IT team is investigating and trying to contain the situation, and it asked everyone in the university community to shut down university devices, disconnect from university Wi-Fi and stay vigilant. The university serves about 14,000 students and employs more than 6,000 staff, according to The Record.
The BYOD ransomware group has claimed the attack on its leak site, saying it encrypted Vanderbilt’s databases and stole student, employee and research data, including “over 1 million SSNs”. BleepingComputer says it received a photo of a computer screen showing a BYOD ransom note and that the link in the note leads to the gang’s own site. Vanderbilt has not said what kind of attack it was, whether systems were encrypted or whether any data was stolen, and has not confirmed that BYOD is responsible, so the gang’s figures should be treated as unverified claims. BYOD is a new group: ransomware researcher Allan Liska told The Record its first victim appeared on September 29, and both outlets link it to last month’s attack on the University of New Mexico Health Sciences Center.
By its 7:15 p.m. update on Monday, Vanderbilt said campus Wi-Fi was available again but access to most university systems and applications remained restricted. It said classes and student services would run on a normal schedule on Tuesday, November 10, and promised its next update by 9 a.m. that day.
How to check if you’re affected
Affected devices are university devices and university-connected systems and cloud services at Vanderbilt; the university has not published any other scope. If you are a Vanderbilt student, faculty or staff member, the university’s own instructions are:
- Shut down university devices and disconnect from university Wi-Fi until the university says otherwise.
- Watch for unexpected pop-ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage; files that were unexpectedly moved, deleted, renamed or modified; unfamiliar applications, messages or prompts; and unexpected requests to enter passwords, approve authentication requests or provide login credentials.
- If you see any of this, do not click links, pop-ups, attachments or unfamiliar prompts, and do not try to investigate or fix it yourself. Shut the device down and contact the IT service desk from a separate device or by telephone.
- Check the university’s incident updates page for the current status of systems before logging in.
Vanderbilt has not said that personal data was taken. Until it does, a reasonable precaution (our suggestion, not the university’s) is to treat unexpected messages that mention the incident and ask for logins or payments with suspicion.