Vanderbilt University cyberattack: What we know

A Vanderbilt University professor was in the middle of class on Monday, Nov. 9, when about 40 files labeled “Read Me” popped up on her screen and a spoken message started playing. That would be creepy enough on its own. But the professor’s account was one glimpse of an ongoing cyberattack that prompted Vanderbilt to tell students and staff to shut down their school-issued devices and disconnect from campus WiFi.

While Vanderbilt has restored access to some of its systems, an update posted to the university’s X account on Tuesday morning stated that “Vanderbilt Information Technology continues to work with government agencies and other partners to manage the situation,” promising further updates.

This Tweet is currently unavailable. It might be loading or has been removed.

Vanderbilt hasn’t said how its IT team first spotted the attack, but there are clues, namely an alleged ransom note on a Vanderbilt computer published by BleepingComputer.

“If you could not tell already, your databases are locked,” a ransomware group calling itself BYOD wrote in a post claiming responsibility for the Vanderbilt cyberattack. “We have your entire estate and research data,” the group added, claiming it had stolen more than 1 million Social Security numbers along with student and employee records. In a separate ransom note obtained by BleepingComputer, the group threatened to release the data unless Vanderbilt negotiated.

Whether BYOD actually has that data is still an open question. A Vanderbilt spokesperson told The Washington Post that the university hadn’t verified the group’s claims.

Just two weeks before the Vanderbilt attack, on Oct. 26, employees at the University of New Mexico Health Sciences Center heard a similar message.

Several UNM Health employees told the Associated Press that a voice played over their work computers, claiming that student, employee, and patient information had been stolen. BYOD also claimed responsibility for that attack. As UNM Health responded, it diverted ambulances to other hospitals and temporarily suspended outpatient surgeries and appointments. (UNM later said its investigation found that the attack affected some staff and student devices but didn’t reach its core systems or servers.)

Vanderbilt’s WiFi was back by Monday evening, but getting online didn’t mean students could get to everything they needed. By Monday night, Vanderbilt’s IT team had cleared Brightspace, where students access course materials, and the YES student portal for use, but File storage services OneDrive and Box were still affected. Vanderbilt said classes and student services would follow their usual Tuesday schedule and told students who were having trouble finishing assignments to ask their instructors about extensions.

This Tweet is currently unavailable. It might be loading or has been removed.

The disruption went beyond coursework. One person told the Nashville Scene they’d lost access to research stored on Vanderbilt’s systems and were relying on personal backups.

The next question is whether Vanderbilt can determine whose information was exposed, if anyone’s.

Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable’s Top Stories newsletter or get Mashable push alerts today.