Vanderbilt University confirmed on Monday morning that it was responding to an 'active cybersecurity incident' that could impact university devices, systems, and cloud-based services.

The university ordered faculty, staff, and students to shut down university-issued devices, disconnect from university Wi-Fi, and remain extremely vigilant, telling anyone who noticed unusual activity to take immediate action. The breach was discovered at 9:50 a.m.

CST according to the live website, while faculty were notified roughly an hour and a half before students received any communication, per The Vanderbilt Hustler.

Students reported pop-up 'README' tabs on university computers containing messaging matching BYOD's leak site, and some professors canceled classes.

The ransomware group BYOD claimed responsibility, posting on its live website: 'your databases are locked. We have your entire estate and research data.

Over 1 million [Social Security numbers], full names, email addresses, phone numbers, student & employee records, full takeover of your DC, whatever was on your network, we possess.' The Hustler has not independently confirmed those claims.

The group also outlined the same breach, including Social Security numbers, on its site, according to The Vanderbilt Hustler.

A website tracking cyberattacks listed Vanderbilt as an active victim of the same BYOD group, which it says has hacked a reported 17 targets since September, per Nashville Scene.

The signature of the attack was unmistakable to those on campus. One Vanderbilt employee described to the Nashville Banner seeing a fake 'system update' notification, then a message about deleting old files, then a ransomware warning — at which point all the computer's files became '.byod' files.

Nashville Scene reports a faculty member saw an unexpected update that appeared to come from Vanderbilt IT rewrite files into the same '.byod' format, a technique used in attacks on a New Mexico hospital and Michigan State University in the previous two weeks.

Staff also noticed Box files deleted by 'administrators' who confirmed they had not accessed them, according to the Banner.

What makes the incident remarkable is its repetition: BYOD has now claimed attacks on Michigan State University and the University of New Mexico Health System within the same two-week window, with Vanderbilt apparently its latest campus-scale target.

The gang's own statements frame the campaign as vigilante-style extortion — in the New Mexico case it apologized for disrupting patient-care systems and offered financial compensation, though the university warned that offer could itself be a scam.

'We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security,' the group wrote, per the Nashville Banner. That posture has done nothing to slow its cadence of claimed university breaches.

The fallout reaches well beyond locked files. A faculty member told Nashville Scene he can no longer access research saved on university systems and is relying on personal backups.

Student government leaders told The Hustler that students are worried about what information was stolen and how it might be used against them, and voiced frustration with the university's communication.

Vanderbilt Health confirmed its hospital and clinical facilities were not impacted, per the Banner.

By Monday evening, campus Wi-Fi had been restored, but 'access to most Vanderbilt systems and applications remains restricted,' and the community was told to return to work and class as scheduled on Tuesday, according to the Nashville Banner.

A 7 p.m. email said Wi-Fi was safe again, and an 8:53 p.m. VUIT call confirmed Brightspace and YES were safe to use while OneDrive and Dropbox remained compromised, The Hustler reports.

VUIT advised against signing into Microsoft services if prompted for credentials, said it had no resolution timeline, and promised another update by 9 a.m. CST Tuesday.

IT officials are working with government agencies and other partners, and a VUIT representative described the effort bluntly: 'The cyberattack is like a building that just exploded and we are trying to gather the pieces.'