Vanderbilt Sued for Cyberattack Exposing One Million Records

A class action lawsuit filed Monday in Davidson County seeks compensatory damages and cybersecurity improvements from Vanderbilt University following a major data breach. The suit names the university as the defendant and alleges it failed to protect the personal information of affected individuals. The filing arrived the same day the ransomware group BYOD claimed credit for the attack.

The complaint states that BYOD gained access to over one million Social Security numbers, names, emails, and employee records. The plaintiffs describe the compromised data as unencrypted and unredacted. They argue the breach resulted from the university's grossly negligent and careless acts and omissions.

The legal team for the plaintiffs is asking the court to order Vanderbilt to improve its cybersecurity measures. They also request annual audits to ensure the university protects sensitive data in the future. The suit seeks compensatory damages for those affected by the exposure of their private information.

BYOD, the ransomware group behind the intrusion, publicly claimed responsibility for the attack on Monday. The group said it accessed the records of more than one million people. The university confirmed the breach on the same day the lawsuit was filed.

The complaint characterizes the university's handling of the data as a failure to protect individuals' sensitive information. The plaintiffs argue that the lack of encryption left the records vulnerable to the cyberattack. The lawsuit was filed by a class of affected individuals who provided their data to the university.

Vanderbilt University has not yet responded to the specific demands for annual audits outlined in the complaint. The university is currently working to contain the breach and notify affected parties. The case marks one of the largest data breach suits filed against a local institution in recent years.

The breach highlights the growing risk of ransomware attacks on educational institutions in the region. Other local organizations have reported similar threats in the past year. The lawsuit seeks to hold the university accountable for the security measures in place before the attack occurred.

The court has not yet set a date for a hearing on the class certification motion. The plaintiffs' attorneys plan to present evidence of the university's security practices during the litigation process. The case will be heard in the Davidson County Chancery Court.

The data exposed in the breach includes employee records alongside personal contact information. The complaint notes that the information was stored without adequate encryption. The plaintiffs say this failure allowed the ransomware group to extract the records with minimal resistance.

Vanderbilt University remains a major employer in Davidson County. The lawsuit affects current and former employees as well as other individuals whose data was held by the institution. The case is expected to draw attention to data protection standards at local universities and large employers.