Vanderbilt University Hit by Cyberattack as New Ransomware Group Targets Universities

Vanderbilt University, based in Nashville, announced a cyberattack on Monday morning and warned that campus devices and systems may be affected. A spokesperson said the IT team is "actively investigating and working to contain the situation." In a longer statement on social media, the university asked everyone to shut down their devices, disconnect from university WiFi and "remain extremely vigilant." Anyone who sees pop-ups, security warnings, changes to files or password requests should turn the device off and report it to campus IT. The university serves about 14,000 students and has more than 6,000 staff.

The incident emerged after the ransomware gang BYOD added the university to its leak site and made several claims about stolen data. The group has also been linked to recent attacks on Michigan State University and the University of New Mexico, where the incident forced one of the state's only top-tier hospitals to turn away ambulances. Ransomware expert Allan Liska said the group only emerged recently, noting "We didn't see their first victim until Sept 29th." Vanderbilt University Medical Center was previously attacked by a ransomware gang in 2023.

The wider picture is concerning. Halcyon reported a 40% increase in ransomware activity between July and September, with 111 groups claiming 2,766 attacks across 122 countries. Trellix said ransomware groups and victim posts hit record numbers from April to September, with new groups making up a third of all posts in August. Both reports pointed to artificial intelligence tools spreading across the cybercriminal ecosystem.