Vanderbilt urges campus to shut down computers amid cyberattack

Vanderbilt University told members of the university community on Nov. 9 to shut down university devices, disconnect from university Wi-Fi and "remain extremely vigilant" as it investigates what it called "an active cybersecurity incident," The Tennessean reported. The guidance, posted across social media at 11 a.m., listed suspicious activity including unexpected pop-ups, security notifications, requests for passwords or authentication approvals, unusual changes to files on OneDrive and Box, and unfamiliar applications or prompts. The university recommended immediate shutdown of affected devices and contacting the IT Service Desk at 615-343-9999 using a separate device or telephone.

The Vanderbilt Hustler reported that campus Wi-Fi became available again by a 7 p.m. university-wide email, though other systems and applications remained restricted, with further updates promised for 9 a.m. CST the next day. The student newspaper said VUIT confirmed a breach and that faculty were notified at 10:06 a.m., an hour and 36 minutes before students received notification. Dean of the Blair School of Music Melissa Rose said VUIT suggested students log off the network: "Everyone is following VU protocols and waiting for further instruction. VUIT is working on it. For now, we are simply asking everyone to stay off the network entirely until we know more." VUIT staff entered classrooms alerting faculty that school-issued computers were not safe to use and urged closing all Microsoft Word documents, OneDrive and Dropbox folders.

A ransomware group identifying as BYOD claimed responsibility on a live website, stating: "If you could not tell already, your databases are locked. We have your entire estate and research data. Over 1 million [Social Security numbers], full names, email addresses, phone numbers, student & employee records, full takeover of your DC, whatever was on your network, we possess," according to The Vanderbilt Hustler. The Hustler had not confirmed the claim. The group said the breach was discovered at 9:50 a.m. CST and originated from the Universal Coordinated Time Zone area stretching from the United Kingdom south through northwestern Africa. Students reported pop-up tabs on university-issued devices with similar messaging.

Nashville Scene reported that a website tracking cyberattacks listed Vanderbilt as the victim of an active attack from the same "BYOD" group that has hacked a reported 17 targets since September, with the database saying hackers obtained extensive personal information including student records and more than 1 million Social Security numbers. One individual reported an unexpected update appearing to be from Vanderbilt IT that rewrote files into a ".byod" format, a strategy used in ransomware attacks at a New Mexico hospital and Michigan State University in the past two weeks.

Displaced students flocked to nearby cafes along 21st Avenue South, packing Starbucks, The Horn and Panera to find Wi-Fi for assignments due that day and spring registration closing Nov. 13, The Tennessean reported. Freshman Cayleigh Maxwell said she couldn't access Microsoft Word documents on OneDrive and her neuroscience professor said a midterm may be moved back. Sophomore Maria Colores de Dios said communication was "wishy-washy" and they were "kept in the dark about what the next steps are." Junior Audrey Nguyen told The Hustler her Medicine, Health and Society professor wrote "No WiFi, No Class" on the chalkboard and said faculty were told not to go on Brightspace. Criminology professor Laurie Woods experienced pop-up tabs and verbal messaging on her university-issued computer with about 40 documents saying "Read Me."

Vanderbilt Health, which includes Vanderbilt University Medical Center, operates as a separate entity but is taking precautions. Spokesperson Craig Boerner said: "We are continuing to monitor the situation closely. The safety of our patients is our top priority and patient care is continuing at all our hospital and clinical locations. We are proceeding with the utmost care and diligence," The Tennessean reported. University spokesperson Julia Jordan said around 3:30 p.m. that classes were proceeding as planned with no further updates as of 6 p.m.