Vanderbilt University · Breach

[Single source] BYOD ransomware claims breach of Vanderbilt University

Nov 09, 2026 · 1 min read

The BYOD ransomware gang listed Vanderbilt University on its leak site, claiming locked databases with student and employee records, over 1 million Social Security numbers and domain controller takeover. The university has not confirmed an incident and no samples have been published. Monitor official channels while awaiting confirmation.

By HIFY Radar newsroom Updated 11/09/2026 01:16 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Observed

The BYOD ransomware gang has listed Vanderbilt University (vanderbilt.edu) on its leak site, stating that the university's databases are locked. The group claims to hold the institution's "entire estate and research data," including more than 1 million Social Security numbers, full names, emails, phone numbers, student and employee records, and a full takeover of the domain controller.

Alleged

Vanderbilt has not confirmed an incident and no samples have been independently verified. The claims come only from the group's own listing and should be treated as an unverified threat-actor claim, not confirmation of a breach.

What happened

Observed

A listing attributed to the BYOD ransomware gang appeared on its leak site naming Vanderbilt University (vanderbilt.edu), with the group saying the university's databases are locked.

Alleged

In the listing, the gang claims to hold "your entire estate and research data," including over 1 million Social Security numbers, full names, emails, phone numbers, student and employee records, and a full takeover of the university's domain controller.

Observed

As of the report, Vanderbilt University has not confirmed an incident, and no data samples cited by the group have been independently verified.

Why it matters

Inferred

If the claims are real, students and staff could face SSN-based identity fraud and targeted phishing, according to the analyst note accompanying the report.

Observed

BYOD is described as a new ransomware gang, active since September, that has recently targeted US universities and a university hospital: a pattern that makes the higher-education sector a repeated focal point for the group.

What to do

Inferred

Treat the listing as an unverified threat-actor claim rather than confirmation of a breach, pending an official statement from Vanderbilt University.

Inferred

Given the claimed exposure of Social Security numbers and contact details, members of the university community should be alert to identity-fraud attempts and targeted phishing referencing the alleged incident.

Confirmed and still uncertain

Observed

Known: the BYOD gang has publicly listed Vanderbilt on its leak site with sweeping claims about locked databases and stolen records, and the gang has been active since September targeting US universities and a university hospital.

Alleged

Unknown: whether an actual breach or ransomware deployment occurred at Vanderbilt, the authenticity of the claimed data, and the accuracy of the claimed domain-controller takeover. No samples have been independently verified and the university has not confirmed an incident.

What people are saying

Alleged

The BYOD gang's own listing states it holds "your entire estate and research data" and claims more than 1 million Social Security numbers along with a full takeover of the domain controller.

Observed

The DailyDarkWeb account, which surfaced the listing, cautions in an analyst note that the claims come only from the group's own listing and should be treated as an unverified threat-actor claim, not confirmation of a breach.

Evolution

Observed

BYOD is a newly active ransomware gang that emerged in September and has recently targeted US universities and a university hospital, according to the report.

Inferred

The listing of Vanderbilt University marks a continued focus on higher-education targets by the group, though the incident itself remains unconfirmed and no timeline for the claimed compromise has been disclosed.

Reach

Observed

1 independent groups, 1 updates, and 3 engagements.

Technical detail

Alleged

The gang says the university's databases are locked, consistent with a ransomware deployment, and claims a full takeover of the university's domain controller: the central authentication and directory service in a Windows environment.

Observed

The disclosure was made via the gang's leak site, naming the domain vanderbilt.edu. No technical indicators, sample files, or intrusion details have been released for independent analysis.

Sources and evidence

Observed

This story is based on a single source: a post by the DailyDarkWeb account on X reporting the BYOD gang's leak-site listing of Vanderbilt University.

Alleged

All breach and data-theft claims trace back to the threat actor's own listing. There is no victim confirmation, no independently verified data sample, and no additional corroboration in the current evidence batch.