Vanderbilt students who logged into campus computers this week were met with a disturbing message: “You have been compromised.”
The university discovered the intrusion Monday morning, after an audio warning appeared on its computer systems. IT staff reportedly went from classroom to classroom, asking students and faculty to close Word documents and disconnect from cloud storage services such as OneDrive and Dropbox.
The breach was detected at about 9:50 a.m. Central time. In the recording, hackers identifying themselves as BYOD told users that their databases were locked and urged the university to contact them. The message warned that refusing to communicate could lead to the network being destroyed.
BYOD claimed responsibility and said it had downloaded Vanderbilt’s network, including private student information. In a statement posted by the group, it claimed to possess more than one million Social Security numbers, along with names, email addresses, phone numbers, student and employee records, research data, and access to the university’s domain controller. These claims have not been independently confirmed.
The group said it would take further action once contact had been made with the university.
The incident is at least the second university cyberattack BYOD has claimed responsibility for in the past week. The group also said it stole data connected to 1.3 million current and former students at Michigan State University.
Vanderbilt students voiced frustration late Monday, with student government leaders asking university officials for answers and saying they had not received enough information.
The university said classes would proceed as usual on Tuesday and asked faculty to teach as scheduled. It had also advised students to disconnect from campus Wi-Fi and exercise caution when using university networks.
Students are worried about what information may have been taken, how it could be used, and whether the breach could affect them personally, student government representatives said. They also criticized the university’s communication and called for timely updates, while asking that students not be penalized academically for disruptions beyond their control.
By Tuesday morning, the student newspaper reported that the university had shared limited information. It also said campus Wi-Fi and services including Outlook, Zoom, and Google accounts were considered safe to use.
