---
title: Vanderbilt University tells everyone to shut down university devices and leave campus Wi-Fi during an active cyberattack | ctxsec
url: https://ctxsec.com/items/vanderbilt-university-active-cybersecurity-incident-shut-down-devices-nov-9
description: "Vanderbilt said Monday morning it is responding to an active cybersecurity incident that may affect university devices, systems and cloud services, and asked students and staff to shut down university devices, disconnect from university Wi-Fi and report anything unusual from a separate device or phone. Its list of warning signs includes unexpected changes to files or permissions in OneDrive and Box and unexpected authentication prompts. Classes continue on schedule. The BYOD ransomware group has claimed the attack on its leak site, alleging encrypted databases and stolen student, employee and research data; Vanderbilt has not confirmed the claim or any data theft."
status: "official (Vanderbilt University incident updates, Nov 9, 2026); the BYOD ransomware group's leak-site claim of encrypted databases and over 1 million SSNs is unconfirmed by Vanderbilt"
published: 2026-11-09
---

> Vanderbilt said Monday morning it is responding to an active cybersecurity incident that may affect university devices, systems and cloud services, and asked students and staff to shut down university devices, disconnect from university Wi-Fi and report anything unusual from a separate device or phone. Its list of warning signs includes unexpected changes to files or permissions in OneDrive and Box and unexpected authentication prompts. Classes continue on schedule. The BYOD ransomware group has claimed the attack on its leak site, alleging encrypted databases and stolen student, employee and research data; Vanderbilt has not confirmed the claim or any data theft.

[← Cybersecurity News](/news) · [markdown](/items/vanderbilt-university-active-cybersecurity-incident-shut-down-devices-nov-9.md)

official (Vanderbilt University incident updates, Nov 9, 2026); the BYOD ransomware group's leak-site claim of encrypted databases and over 1 million SSNs is unconfirmed by Vanderbilt

2026-11-09

### Vanderbilt University tells everyone to shut down university devices and leave campus Wi-Fi during an active cyberattack

- Vanderbilt Health, a separate entity, told local media its systems have not been affected.
- The university's own guidance is a useful template for an active-intrusion notice: don't click, don't troubleshoot, power off, report out of band.

Sources: [Vanderbilt University News: Nov. 9 Active Cybersecurity Incident Updates](https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/)