Cybercrime group claims it stole social security numbers during ongoing Vanderbilt breach, report says. Here’s what we know

What This Story Is About

• Vanderbilt University is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services.

Why It Matters

• The university asked community members on Monday to shut down university devices and disconnect from university Wi-Fi.

What Happens Next

• Vanderbilt’s IT team is investigating and working to contain the incident. Anyone who notices suspicious activity should contact the IT service desk using a separate device or phone.

NASHVILLE, Tenn. (WSMV) - Vanderbilt University is responding to a cybersecurity breach that sent a disturbing threat to some university devices.

Follow our updates on the response below.

11:15 a.m. Tuesday Update: When reached by email, a spokesperson for Vanderbilt did not answer questions from WSMV4 on if BYOD is the perpetrator of the cyber breach. They also did not offer a comment on its claims to have stolen sensitive personal information, including social security numbers.

Instead, the university referred WSMV4 back to its website, saying the information provided there is all they have to share at this time.

“The website will continue to be updated with additional information as needed,” the spokesperson’s email said, in part.

10:35 a.m. Tuesday Update: BYOD ransomware has claimed responsibility for the breach. That name could be heard in the video that played on some breached university devices.

According to Ransomware.live, a website that tracks ransomware attacks, BYOD claims to have taken over a million social security numbers during the attack, as well as names, emails, phone numbers and records for both employees and students.

Cyber risk protection organization CyberXTron says BYOD is a new ransomware group that first emerged in September.

Among its alleged high-profile victims is Trump Mobile, the wireless service launched by Donald Trump Jr. and Eric Trump, according to CyberXTron.

“The group’s documented pattern is data theft followed by publication on a leak site used to pressure victims, run through a dedicated page where stolen data is displayed,” the CyberXTron website says, in part.

WSMV4 has reached out to Vanderbilt University for comment.

9 a.m. Tuesday Update: The university said Tuesday morning that Vanderbilt students, staff and faculty may now access their personal accounts, including Google accounts.

Additionally, Vanderbilt says the following systems are now available:

• Campus WiFi
• Okta: Continue to use multi-factor authentication (MFA)
• Vanderbilt email (Outlook): Vanderbilt email is available on Vanderbilt and personal devices
• Brightspace
• Zoom
• YES (Your Enrollment Services): Sophomore class registration is proceeding as scheduled

“All other Vanderbilt systems and applications remain restricted, including CampusPrint,” a statement from Vanderbilt said.

Any suspicious activity should be immediately reported to the IT Service Desk immediately (615-343-9999). The university noted that its work to “contain and respond to this incident have also constrained standard communications.”

7:15 p.m. Monday Update: NASHVILLE, Tenn. (WSMV) - Vanderbilt University said after a cybersecurity incident affected the university’s devices, systems and cloud-based services, the campus Wi-Fi is now available.

However, access to most Vanderbilt systems and applications remains restricted.

“We know this has disrupted important work and caused frustration across the university,” Vanderbilt said in a statement on Facebook. “Vanderbilt Information Technology is working with government agencies and other partners to manage this situation.”

On Tuesday, Nov. 10, Vanderbilt said they are expected to operate on a normal schedule. Classes will proceed as normal and teachers are expected to teach classes as scheduled.

Students are asked to contact their course instructors for any additional guidance, including flexibility on work deadlines.

Vanderbilt said student services will also operate normally, and Student Care Network offices are open and hosting appointments.

For faculty, Vanderbilt said if you have grant submissions due this week to contact “Vice Provost for Research and Innovation Susan Marguiles, whose team can provide focused support to ensure timely submission.”

Vanderbilt said they will provide an update by 9 a.m. with the status of the systems and applications.

Initial Report: Vanderbilt University is asking its community to shut down university devices and disconnect from university Wi-Fi as it responds to an active cybersecurity incident.

The incident may affect university devices, systems and cloud-based services, Vanderbilt said. Its information technology team is investigating and working to contain the situation.

The university urged community members to watch for suspicious activity, including unexpected pop-ups, changes to files or cloud storage, unfamiliar applications, and unexpected requests for passwords or authentication approvals.

Vanderbilt said anyone who notices unusual activity should not click links, attachments, or unfamiliar prompts, or try to troubleshoot the issue. They should shut down the device immediately and contact the IT service desk from a separate device or by phone.

What you need to do, according to Vanderbilt: “IMMEDIATE ACTION REQUIRED”

1. DO NOT CLICK on any links, pop-ups, attachments, or unfamiliar prompts.
2. DO NOT attempt to investigate, troubleshoot, or resolve the issue yourself.
3. SHUT DOWN YOUR DEVICE IMMEDIATELY to help prevent potential further security risks.
4. CONTACT THE IT SERVICE DESK IMMEDIATELY using a separate device or telephone to report the incident.

“Vanderbilt Health (VH) is aware of a possible incident involving Vanderbilt University’s IT systems,” Vanderbilt Health shared with WSMV4.

“Vanderbilt University and Vanderbilt Health are legally and financially separate entities. Vanderbilt Health is taking the necessary precautions to ensure the security of our IT systems which so far have not been impacted. However, we are continuing to monitor the University’s situation closely. The safety of our patients is our top priority and patient care is continuing at all our hospital and clinical locations. We are proceeding with the utmost care and diligence.”