A Vanderbilt University professor was in the middle of class on Monday, Nov. 9, when about 40 files labeled "Read Me" popped up on her screen and a spoken message started playing. That would be creepy enough on its own. But the professor's account was one glimpse of an ongoing cyberattack that prompted Vanderbilt to tell students and staff to shut down their school-issued devices and disconnect from campus WiFi.

While Vanderbilt has restored access to some of its systems, an update posted to the university's X account on Tuesday morning stated that "Vanderbilt Information Technology continues to work with government agencies and other partners to manage the situation,” promising further updates.

Vanderbilt hasn’t said how its IT team first spotted the attack, but there are clues, namely an alleged ransom note on a Vanderbilt computer published by BleepingComputer.

"If you could not tell already, your databases are locked," a ransomware group calling itself BYOD wrote in a post claiming responsibility for the Vanderbilt cyberattack. "We have your entire estate and research data," the group added, claiming it had stolen more than 1 million Social Security numbers along with student and employee records. In a separate ransom note obtained by BleepingComputer, the group threatened to release the data unless Vanderbilt negotiated.

Whether BYOD actually has that data is still an open question. A Vanderbilt spokesperson told The Washington Post that the university hadn't verified the group's claims.

Just two weeks before the Vanderbilt attack, on Oct. 26, employees at the University of New Mexico Health Sciences Center heard a similar message.

Source link