BYOD claims data theft in Vanderbilt breach

Vanderbilt University is responding to an active cybersecurity incident that affected devices, systems, and cloud services.

The university initially asked community members to shut down their devices and disconnect from campus Wi-Fi on Monday.

On Tuesday, Nov. 10, the school confirmed that operations would proceed on a normal schedule.

Classes are continuing as scheduled, and student services are open.

A ransomware group known as BYOD claimed responsibility for the attack.

According to Ransomware.live, BYOD states it stole more than one million Social Security numbers during the intrusion.

The group also claims to have taken names, emails, phone numbers, and records for both employees and students.

CyberXTron, a cyber risk protection organization, identified BYOD as a new ransomware group that first appeared in September.

The organization noted that BYOD has a documented pattern of stealing data and then publishing it on a leak site to pressure victims.

Trump Mobile, the wireless service launched by Donald Trump Jr. and Eric Trump, is listed among the group's alleged high-profile victims.

Vanderbilt said its information technology team is working with government agencies and other partners to manage the situation.

As of Tuesday morning, students, staff, and faculty may access personal accounts, including Google accounts, through the Okta system with multi-factor authentication enabled and Vanderbilt email via Outlook on university or personal devices and Brightspace, Zoom, and Your Enrollment Services, with sophomore class registration proceeding as scheduled, while all other systems, including CampusPrint, remain restricted, and anyone noticing suspicious activity should contact the IT service desk at 615-343-9999 using a separate device or phone, as the university stated that its efforts to contain and respond to the incident have constrained standard communications, and it will continue to update its website with additional information as needed, according to a spokesperson who said the website will continue to be updated with additional information as needed, and Vice Provost for Research and Innovation Susan Marguiles, whose team can provide focused support to ensure timely submission for faculty with grant submissions due this week, as the university noted that it knows this has disrupted important work and caused frustration across the university, and Vanderbilt Health, which is legally and financially separate from the university, said it is aware of the possible incident involving the university's IT systems and is taking necessary precautions to ensure the security of its own IT systems, which so far have not been impacted, and is continuing to monitor the university's situation closely, with patient care continuing at all hospital and clinical locations and patient safety remaining the top priority, and the university urged community members to watch for suspicious activity including unexpected pop-ups, changes to files or cloud storage, unfamiliar applications, and unexpected requests for passwords or authentication approvals, and to not click links, attachments, or unfamiliar prompts, or try to troubleshoot the issue, but to shut down the device immediately and contact the IT service desk from a separate device or by phone, and to contact their course instructors for any additional guidance, including flexibility on work deadlines, and to note that Student Care Network offices are open and hosting appointments, and that the university will provide an update by 9 a.m. with the status of the systems and applications.