Vanderbilt lifts device shutdown order, but cyberattack restrictions persist

All other Vanderbilt systems and applications remained restricted, including CampusPrint. The university also asked anyone seeing previously unreported suspicious activity when powering on a device to contact its IT service desk immediately. It said containment and response efforts had constrained standard communications, and that its IT team was working with government agencies and other partners.

Vanderbilt’s updates trace the shutdown and limited reopening on Nov. 9–10. Other systems, including CampusPrint, remained restricted Tuesday morning. Graphic: Magica; source: Vanderbilt University. Source: Vanderbilt University News.

A normal timetable still brought disruption

The university’s own service notices show how the shutdown affected work beyond the classroom schedule. Writing Studio and Tutoring Services announced it was closing from noon Monday and canceling afternoon and evening appointments because of the directive to shut down computers. The office anticipated reopening Tuesday, but that notice did not confirm it had done so.

Students interviewed in a campus report described difficulty completing work when so many assignments depended on online access. Vanderbilt also offered focused support for faculty with grant submissions due that week.

The separately operated Vanderbilt Health said its own systems had not been affected and patient care was continuing normally, according to reporting on its response.

Vanderbilt University Medical Center became legally and financially independent from the university in 2016, while retaining research and teaching connections. In a separate Nov. 9 precautionary notice, the health system told employees not to log into university IT resources or connect USB drives, laptops or external storage devices to university systems.

Data-theft claims exceed what is confirmed

BYOD, a ransomware group that emerged in 2026, claimed responsibility and alleged that it had encrypted Vanderbilt databases and stolen student, employee and research information. Its leak-site message claimed possession of more than 1 million Social Security numbers. A university spokesperson said Vanderbilt had not confirmed those numbers, according to a report on Monday’s response.

Evidence linking the group to the incident extended beyond its leak-site assertion. A technical report described a photograph of an alleged Vanderbilt computer displaying a BYOD ransom note, with a link it verified belonged to the group. The note threatened data release and further disruption if the university did not negotiate. The report also described video of devices playing a warning naming BYOD.

Those messages support the attribution to BYOD, but do not establish the volume or contents of stolen data. Vanderbilt had not officially confirmed BYOD’s involvement, device encryption or data theft. The claimed Social Security number total is an attacker allegation, not a count of verified victims.

The group had previously claimed an attack on the University of New Mexico Health Sciences Center that disrupted patient care and academic activities, the technical report said. That precedent illustrates the potential consequences of an outage, but does not establish that Vanderbilt suffered the same compromise or losses.

The next disclosures must establish scope and recovery

Vanderbilt said it would continue providing updates throughout the week for as long as necessary. Its Tuesday morning notice did not give a timetable for restoring the remaining restricted systems or explain the attack’s entry point.

The next consequential disclosures are whether the university can confirm what was accessed or taken, which users are affected, and when the remaining services can return. Permission to power devices back on is a concrete recovery step. It leaves the separate question of data exposure unanswered.