Vanderbilt orders staff to power off devices after ransomware hit

Vanderbilt University ordered faculty and staff to power off university computers and disconnect from the campus Wi-Fi on Monday morning. The directive followed the confirmation of an active cybersecurity incident that threatened devices, internal systems, and cloud services.

The disruption began earlier in the week. One employee reported that a system update notification appeared on her screen on Thursday. That alert was quickly replaced by a message stating that old files were being deleted. A ransomware warning then popped up with a link for more information. At that moment, all files on the computer changed to a format ending in .byod.

A second source, who was not authorized to speak on the record, said the university IT help line had crashed. The strain on technical support matched the urgency of the situation as staff struggled to work.

Vanderbilt Health officials said their hospital and clinical facilities were not impacted. A spokesperson for the health system stated that officials were proceeding with the utmost care and diligence. The university urged everyone to remain extremely vigilant while the team worked to contain the breach.

The ransomware group BYOD claimed responsibility for the attack in messages posted online on Monday. The group has also recently claimed responsibility for cyberattacks on Michigan State University and the University of New Mexico Health System.