Vanderbilt Hackers Claim a Million Social Security Numbers as University Scrambles to Restore Systems

Vanderbilt University students in Nashville sat down at school computers this week and were greeted by an unsettling announcement, TheBlaze reported: "You have been compromised." ^[1] A newly formed ransomware gang calling itself BYOD has claimed responsibility and says it walked away with more than a million Social Security numbers. The university has not confirmed that claim. ^[3][5]

According to the student newspaper, the Vanderbilt Hustler, as cited by TheBlaze, the breach was first discovered at 9:50 a.m. Central time on Monday, November 9. ^[1] Vanderbilt announced that morning that it was responding to an active cybersecurity incident that could affect university devices, systems and cloud services, and a spokesperson told The Record that the school's IT team was "actively investigating and working to contain the situation." ^[2] The university told students, faculty and staff to shut down school devices, get off campus Wi-Fi, and report warning signs such as unexpected pop-ups, altered or missing files, unfamiliar applications or surprise password requests. ^[2][3] TheBlaze reported that IT staff went from classroom to classroom telling people to close Word documents and disconnect from cloud services such as OneDrive and Dropbox. ^[1]

What the Hackers Claim

BYOD added Vanderbilt to its leak site early Monday, The Record reported. ^[2] According to BleepingComputer, the group's post claimed the university's databases were locked and that it held more than a million Social Security numbers, along with full names, email addresses, phone numbers and student and employee records. ^[3] A ransom note photographed on an affected screen and shared with BleepingComputer declared, "We have all of your data including your backups," and threatened to release stolen files and cause more disruption if Vanderbilt did not negotiate. ^[3] Infected machines also played an audio message announcing that the network had been compromised by BYOD. ^[1][3]

Those are the boasts of criminals, not established facts. BleepingComputer noted that Vanderbilt had not said whether data was stolen or devices were encrypted, and had not officially confirmed BYOD's involvement. ^[3] Inside Higher Ed reported Wednesday that the university did not answer questions about what data was compromised, whether it paid a ransom, or when full service would return. ^[5] For scale, The Record reported that Vanderbilt serves about 14,000 students and employs more than 6,000 staff. ^[2]

The gang is new but busy. CyberScoop reported that BYOD emerged in September and has since claimed attacks on academic and health care institutions, including the University of New Mexico Health Sciences Center last month, where outages disrupted patient care. ^[4] The Record reported that BYOD recently hit Michigan State University and is believed to have leaked data on 3,615 prominent Trump Mobile customers, which drew scrutiny from Congress. ^[2]

Campus Life Disrupted

Campus Wi-Fi returned Monday night and classes continued as scheduled, according to Inside Higher Ed, which reported that email, Zoom, the Brightspace course system, Okta logins and enrollment services were restored by Tuesday morning while "all other Vanderbilt systems and applications remain restricted." ^[5] The outage kept some students from registering for spring classes, with the registration window set to close Friday. ^[5] CyberScoop reported the university said its IT department continues to work with government agencies and other partners, and it quoted a Vanderbilt IT staffer, via the Hustler, likening the attack to "a building that just exploded." ^[4]

Student leaders want more than reassurance. The student government said students are worried about the extortion threats and what information was taken, complained that the university had not communicated clearly, and asked that no one be penalized academically. ^[1][4] The university, for its part, has moved quickly to bring core services back online. ^[4][5]

What Families Should Do Now

Higher education has become a favorite target. Sterling Wilson, chief technology officer at IGEL, told Inside Higher Ed that campuses are exposed because of countless unmanaged personal devices, scattered IT operations and vast stores of identity data, while Gary Barlet of Illumio argued schools must be able to wall off compromised systems quickly so the rest of campus keeps running. ^[5] In the publication's 2026 survey, 59 percent of campus technology chiefs named a critical breach or ransomware event as their top worry. ^[5]

Related The Nvidia Spy Scandal Explained: A CEO's Admission, a Chip Giant on Edge and Washington's Chip Fight With China

For parents who entrust colleges with their children's most sensitive personal information, the lesson is plain: an institution that collects that much owes families prompt, clear answers when it may have been exposed. Families, however, do not have to wait for a notification letter to protect themselves.

The Federal Trade Commission says a credit freeze is free, does not affect a credit score, and stops anyone, including the account holder, from opening new credit until it is lifted. ^[6] It must be placed separately with each of the three bureaus: Equifax, Experian and TransUnion. ^[6] A free fraud alert, requested from one bureau that must notify the other two, requires lenders to verify a person's identity and lasts one year. ^[6] Parents may also request a free freeze for a child under 16. ^[6] Anyone tied to Vanderbilt should also be wary of unexpected messages about the attack and watch their accounts closely.