Vanderbilt University

Summary

Vanderbilt University experienced an active cybersecurity incident involving a ransomware group called BYOD. The institution urged faculty and staff to shut down devices, disconnect from Wi-Fi, and remain vigilant as the attack potentially impacted university devices, systems, and cloud-based services. One employee reported seeing a system update notification followed by file deletion warnings and a ransomware message before files were renamed with a .byod extension. The university's IT help line reportedly crashed, while hospital and clinical facilities were stated to be unaffected. The ransomware group claimed responsibility online and has also claimed attacks on other educational and healthcare institutions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Vanderbilt University confirmed an apparent cyberattack in a statement posted to social media on Monday morning. The university described the event as an active cybersecurity incident as the school worked to investigate and contain it. In response, the institution urged faculty and staff to shut down university devices, disconnect from university Wi-Fi, and remain extremely vigilant. Officials noted that the incident could impact university devices, systems, and cloud-based services. A Vanderbilt Health spokesperson confirmed that its hospital and clinical facilities had not been impacted. The spokesperson added that officials were proceeding with the utmost care and diligence. The university characterized the story as developing and indicated it would update as more information became available.

One Vanderbilt employee described to the Nashville Banner what she saw on her computer after starting it up on Thursday. A notification indicated that the computer was running a system update. That notification was followed by another saying that it was deleting old files. Then came a warning about a ransomware attack with a link to click for more information. At that point, all of the computer's files became .byod files. Another source, who was not authorized to speak on the record, said that the IT help line for Vanderbilt's employees had crashed. Messages attributed to the ransomware group BYOD online Monday said it was behind the Vanderbilt breach. The group has also recently claimed responsibility for cyberattacks on Michigan State University and the University of New Mexico Health System.

Sources

Sources available to members: 2 sources.