Attackers Claim to Have Stolen Data on Over 1 Million Vanderbilt Students and Staff

Vanderbilt University (VU) officials urged students and faculty to disconnect their devices from school Wi-Fi after a likely ransomware attack hit the institution on Monday, according to both local news stations and the student paper. Attackers claim to have stolen data on over a million individuals associated with the university. “Everyone is following VU protocols and waiting for further instruction,” Dean of the Blair School of Music Melissa Rose told students in a statement shortly after 10:00 a.m. local time, according to The Vanderbilt Hustler (no relation to the other Hustler). “VUIT is working on it. For now, we are simply asking everyone to stay off the network entirely until we know more.” “DO NOT attempt to investigate, troubleshoot, or resolve the issue yourself,” VU officials wrote in another notification, per Axios. “SHUT DOWN YOUR DEVICE IMMEDIATELY to help prevent potential further security risks.” According to the Hustler, the university also dispatched IT staff to warn faculty to shut down their computers. The paper reported that the university also urged users to close all instances of Microsoft Word documents and/or OneDrive and Dropbox folders. Students using university-issued devices reported their device desktops suddenly filling with copies of the attackers’ readme file, as well as popups. It’s not clear how much data was lost, though the Hustler reported that some professors had canceled classes despite a statement from VU officials that classes are “proceeding as scheduled.” Nashville Scene reported that one individual reported their files being rewritten into an encoded “.byod” format, while another told the newsweekly that their research hosted on university systems was inaccessible, and they had to pivot to personal backups. According to a ransom message uploaded to Ransomware.live, a platform that aggregates publicly visible information on cyberattacks, the threat actor known as BYOD has taken credit. “If you could not tell already, your databases are locked,” the alleged attackers claimed on the site. “We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.” BYOD’s name is a mocking reference to “Bring Your Own Device,” or policies that allow users to access corporate networks on their personal devices. These policies essentially trade cost and convenience for an increased attack surface and risk levels that security firm Pwnie Express refers to as the “Internet of Evil Things.” Security teams tend to have far less control over or insight into personal devices. In the context of universities, with their hordes of students and third-party service providers, this is a problem that can only be resisted, not solved. Like hospitals, universities are also favored targets for ransomware gangs both because of the sheer amount of data they host and the high cost of disruption to normal activities. As Axios noted, BYOD has previously claimed credit for attacks on Michigan State University and the University of New Mexico Health System. Vanderbilt’s press office did not immediately return a request for comment from Gizmodo, but we’ll update if we hear back.