Vanderbilt went dark, but the 1 million stolen records figure is the attackers' claim

Vanderbilt University told students, faculty, and staff on November 9 to shut down university devices, disconnect from campus Wi-Fi, and stay vigilant while it responded to an active cybersecurity incident. The university said the incident could affect university devices, systems, and cloud-based services.

Campus Wi-Fi was later restored, but access to most Vanderbilt systems and applications remained restricted. The university told people to return to work and class as scheduled on Tuesday. Vanderbilt Health, which operates separately from the university, said its own systems were not affected and that patient care continued normally.

A ransomware group calling itself BYOD claimed responsibility and alleged it stole university data and Social Security numbers, claiming data on more than 1 million students and staff. That figure is the attackers' claim. Vanderbilt has not confirmed a ransom demand, a count of affected devices, how much data was accessed, or a data breach.

That gap is the story. A university can confirm an active incident and order a campus offline without confirming that data left its network. The 1 million number is a claim by an entity with an incentive to inflate it. Until Vanderbilt confirms scope, the only verified facts are operational: devices were shut down, Wi-Fi went down and came back, most systems stayed restricted, and a separate health system said it was unaffected.

Universities hold student records, employee data, and research, and they run sprawling networks that mix personal devices, cloud services, and legacy systems. That combination makes them attractive targets and makes scope hard to establish quickly. The same pattern — attackers claim, institutions decline to confirm — is likely to repeat elsewhere.

The next concrete signal will be whether the university restores full access or confirms a breach.