Breaches

BYOD gang claims Vanderbilt attack and 1m Social Security numbers

Vanderbilt told staff and students to power down devices as BYOD claimed data on a million people. What UK universities and NHS bodies should check now.

Warning symbol over a university network graphic with the headline Vanderbilt powers down campus devices

Vanderbilt University told students and staff on Monday to power down their devices and get off campus Wi-Fi after an active cyber incident, on the same day the BYOD ransomware gang added it to its leak site. The group says it holds more than a million Social Security numbers and controls the domain controller, but the university has confirmed none of that.

What happened

On the morning of Monday 9 November 2026, Vanderbilt University in Nashville warned its community of roughly 14,000 students and more than 6,000 employees that university devices, systems and cloud services might be affected by an ongoing security incident. Staff and students were told to shut down university machines, disconnect from the campus wireless network and stay alert. A university spokesperson told Recorded Future News that the IT team was investigating and trying to contain the problem.

The warning came the same day as a post on the leak site of BYOD, a ransomware and extortion crew that first appeared at the end of September. In that listing, BYOD says it has locked Vanderbilt’s databases and taken what it calls the university’s “entire estate and research data”. It also claims to hold more than one million Social Security numbers, plus contact details and personnel and student files. It boasts of a full takeover of the domain controller. No ransom figure or deadline has been posted. The group says it will take the university down once contact is made.

Vanderbilt has not used the word ransomware, has not named BYOD and has not said whether any data left its network. For now, every number in the story comes from the attacker.

The technical picture

What we can say comes from people on campus, as relayed by Gizmodo and local reporting. Students using university-issued laptops saw pop-ups and copies of a ransom readme file appearing on their desktops. The Nashville Scene reported one person’s files had been rewritten with a “.byod” extension, and another user could no longer reach research data stored on university systems. According to the student newspaper, IT staff warned faculty to shut their computers down, and users were asked to close Word documents and OneDrive and Dropbox folders.

Taken together, that looks like encryption reaching managed endpoints and synced cloud storage, not just a quiet data theft. Ordering a whole research university to power down is a step you take only when you think something is still spreading. The domain controller claim is unproven, but it would fit the pattern. Ransomware that lands on thousands of managed machines in one go is usually pushed from a central identity or management system rather than spread one host at a time.

BYOD has moved fast. Ransomware analyst Allan Liska told The Record that the group’s first victim appeared on 29 September. Since then it has claimed Michigan State University, claiming records on 1.3 million past and present students. MSU described that incident as a possible credential compromise and said it had no evidence that its central Active Directory had been breached. The gang also hit the University of New Mexico, whose hospital had to divert ambulances, before the group reportedly apologised and handed over decryption keys for free. Earlier this month it listed the UK-headquartered hotel group IHG, which we covered at the time. That claim, alleging access through a weak LDAP bind password, is still unverified.

Timeline of BYOD ransomware activity from its first victim on 29 September to the Vanderbilt University listing on 9 November 2026

Why it matters for UK organisations

BYOD has already named one UK-headquartered company in its first six weeks, and its victims so far span universities, a hospital, a mobile operator and a hotel chain. It shows no sign of filtering by country.

UK universities share the features that make Vanderbilt attractive. They run large, open networks where individual departments often run servers outside central oversight. They have thousands of unmanaged personal devices, huge identity directories full of students and alumni, and research data that cannot easily be recreated. NHS trusts and councils are no different. One reused or weak credential on a flat network can turn into an estate-wide outage within hours.

There is also a regulatory point. If something similar happened here, an affected institution would have 72 hours under UK GDPR to tell the ICO about a personal data breach, often well before forensics could confirm what was taken. Vanderbilt’s careful public wording, saying systems “may be” affected, is a reasonable model for those first hours. Say what you know, avoid repeating the attacker’s numbers as fact, and give clear instructions.

Expert view

In my experience, the leak-site post is the least reliable part of an incident like this. Extortion crews put the biggest number they can defend on the page, because that number is what gets paid. Treat “more than a million records” as an opening bid until a notification letter or regulator filing gives an official count. Equally, do not dismiss it. MSU’s experience shows the gang does go after identity systems, even where the victim later finds the core directory intact.

The detail that worries me most is the domain controller claim. When we test university and healthcare estates, the path from a single phished account to domain admin is still too often measured in hours, not weeks. Stale service accounts and readable LDAP are the usual culprits. If BYOD’s IHG and Vanderbilt claims both centre on directory access, that is the control to look at first.

Vanderbilt deserves credit for the speed of its stop order. It is disruptive, but it is one of the few moves that reliably limits damage once encryption has started.

What to do now

  1. Audit directory exposure this week. Find accounts that can bind to LDAP with weak or never-rotated passwords, remove anonymous binds and enforce LDAP signing. This maps to the Cyber Essentials user access control and secure configuration requirements.
  2. Lock down privileged identities. Put tier-zero accounts (domain admins, backup operators, management servers) behind phishing-resistant MFA. Limit where they can log on, and alert on any new member of a privileged group.
  3. Segment campus and clinical networks. Student, guest and departmental networks should not be able to reach domain controllers or backup infrastructure directly.
  4. Protect synced cloud storage. Check that OneDrive, SharePoint and Dropbox version history and recycle-bin retention will let you roll back mass encryption, and that backups are offline or immutable.
  5. Rehearse the stop order. Decide who can order an organisation-wide power-down, and how that message travels if email and chat are untrusted.
  6. Prepare your ICO clock. Have a draft breach notification and a holding statement ready, so the 72-hour deadline does not force you to guess or to repeat the attacker’s figures.
  7. Watch for follow-on phishing. Warn staff and students that criminals often send fake “IT security” messages after a public incident, and give them one trusted way to check.

Bottom line

Vanderbilt has confirmed an active incident serious enough to switch off its campus. BYOD has claimed a million identities and control of the directory, but has offered no proof. The gang is six weeks old, works across sectors and countries, and has already named a UK-headquartered firm. UK universities, health bodies and large employers should assume they are on its list and check their directory hygiene before it gets to them.

Sources

Related Posts