Vanderbilt University is investigating an active cybersecurity incident affecting university devices, systems and cloud-based services. In its initial November 9 notice, the university asked members of the campus community to shut down university devices, disconnect from university Wi-Fi and remain alert for suspicious activity.
In a later update at 7:15 p.m. on November 9, Vanderbilt said campus Wi-Fi was available again, although access to most university systems and applications remained restricted. The university said classes would proceed on a normal schedule on November 10 and that its IT team was working with government agencies and other partners to manage the incident. The updates appear on Vanderbilt’s official incident page.
The university’s initial notice listed unexpected pop-ups, changes to files or permissions in OneDrive, Box and other cloud storage, files that had been moved, deleted, renamed or modified, unfamiliar applications, and unexpected password or authentication requests as possible signs of suspicious activity. The notice did not say that each of those conditions had been confirmed on university systems.
A website claiming to represent the BYOD ransomware group posted a claim of responsibility, alleging it had encrypted Vanderbilt’s databases and stolen student, employee and research data. Vanderbilt has not confirmed the group’s involvement or whether data was stolen. The Washington Post reported that a university spokesperson had not confirmed the data totals cited by the group, while BleepingComputer reported that it had seen an alleged BYOD ransom note and a video associated with the incident.
Vanderbilt Health said its systems had not been affected so far and that patient care was continuing at all hospital and clinical locations in a November 9 notice.
Vanderbilt’s IT status page remains under maintenance and warns that displayed service information should not be treated as accurate until the work is complete.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
