Vanderbilt orders staff to disconnect after ransomware hits systems

Vanderbilt University told its workforce to immediately shut down computers and disconnect from the campus network on Monday morning. The administration issued these instructions while investigating an active cybersecurity incident. The school warned the breach could affect local devices, internal systems, and cloud-based services.

A university statement posted to social media confirmed the apparent attack. Officials asked faculty and staff to remain highly vigilant during the investigation. The disruption forced employees to pause their digital work while IT teams worked to contain the threat.

One Vanderbilt employee described the sequence of events on their screen on Thursday. A notification indicated a system update was running, followed by a message stating that old files were being deleted. A ransomware warning then appeared with a link for more information. At that moment, all files on the computer changed to the .byod extension.

Another source, who was not authorized to speak on the record, reported that the internal IT help line had crashed. This failure likely compounded the difficulty for staff trying to resolve technical issues during the initial phase of the attack.

A spokesperson for Vanderbilt Health confirmed that hospital and clinical facilities had not been impacted. The official said the team was proceeding with the utmost care and diligence. This distinction separates the academic campus systems from the medical network.

The ransomware group BYOD claimed responsibility for the breach in messages posted online on Monday. The group has recently taken credit for attacks on Michigan State University and the University of New Mexico Health System.