Vanderbilt Halts Network Activity Amid Cybersecurity Incident

Vanderbilt University is responding to an active cybersecurity incident that may affect its devices, internal systems, and cloud-based services.

The university’s Information Technology team is investigating the situation and working to contain the threat. Officials have asked all members of the community to shut down university devices and disconnect from university WiFi. The goal is to reduce the risk of the incident spreading across the network.

IT staff advise users to watch for specific signs of compromise. These signs include unexpected pop-ups, warnings, or security notifications. Users should also look for unusual changes to files, folders, or permissions in OneDrive, Box, or other cloud storage platforms. Files may be moved, deleted, renamed, or modified without user input. Other indicators include unfamiliar applications, messages, or prompts appearing on screens. Users should also be wary of unexpected requests to enter passwords, approve authentication requests, or provide login credentials.

The university issued immediate action instructions for anyone who notices unusual or suspicious activity. Individuals must not click on any links, pop-ups, attachments, or unfamiliar prompts. They should not attempt to investigate, troubleshoot, or resolve the issue on their own. Instead, users should shut down their devices immediately to help prevent further security risks. After powering down, they must contact the IT Service Desk right away using a separate device or telephone to report the incident.

The advisory defines the scope of the potential impact on university operations. It covers local hardware as well as remote data storage services. The IT team remains the primary point of contact for reporting and resolving these technical issues during the active incident.