The facts
Vanderbilt said on 9 November that it was responding to an active cybersecurity incident that may affect university devices, systems and cloud services, and instructed its community to shut down devices and disconnect from campus Wi-Fi. [1][3]
Vanderbilt said classes were proceeding on their normal schedule on 9 November. [1][3]
Nashville Scene reports university staff, faculty and students experienced device or file problems, including files changed to a .byod extension; the university did not identify the cause in its public update. [1][2]
Vanderbilt University Medical Center told Axios its own systems were not affected and patient care continued normally. [3]
A ransomware group claimed responsibility, but Vanderbilt had not confirmed its involvement or whether any information was compromised. [3]
In a 7:15 p.m. CST update on 9 November, Vanderbilt said campus Wi-Fi had been restored, most systems and apps remained restricted, Tuesday classes were expected to follow the normal schedule, and another update was due by 9 a.m. Tuesday. [1]
Still unconfirmed
- The identity of the attacker, whether ransomware was involved, and whether any university or personal data were accessed or exfiltrated.
- The full operational scope, number of affected devices or accounts, recovery timeline and final effect on research and university services.
Corrections & updates
Substantive update, 10 November UTC: Vanderbilt’s official 7:15 p.m. CST update on 9 November says campus Wi-Fi was restored, most systems and apps remained restricted, normal Tuesday classes were expected, and a further update was due by 9 a.m. Tuesday. Attacker attribution, ransomware and data compromise remain unconfirmed.
Sources
References support the numbered facts above. Source checks: 10 Nov 2026, 02:46 UTC.
Vanderbilt’s official update establishes the continuing incident and its partial recovery, but does not name an attacker or confirm ransomware or data compromise. Nashville Scene reports user-observed file and network problems; Axios separately reports that Vanderbilt Health was unaffected. The recovery status is dated to the university’s 7:15 p.m. CST 9 November update.
- Nov. 9: Active Cybersecurity Incident Updates
Vanderbilt University · Primary source · 9 Nov 2026
Opened Vanderbilt’s official incident updates. Its 7:15 p.m. CST Monday update says campus Wi-Fi is available again, most systems and apps remain restricted, normal Tuesday class schedules are expected, and another update is due by 9 a.m. Tuesday. The university still describes an active cybersecurity incident.
- Ransomware Attack Puts Vanderbilt on Lockdown
Nashville Scene · Reporting · 9 Nov 2026
Opened local reporting with interviews from university staff, students and faculty who described network or file problems. The reported .byod file changes are observations from sources, not a university finding about malware or data theft.
- Vanderbilt urges campus to shut down computers amid cyberattack
Axios · Reporting · 9 Nov 2026
Opened the full report. Vanderbilt told Axios classes continued normally; Vanderbilt Health said its own systems were unaffected and patient care continued. Axios reports a ransomware group claimed responsibility, while Vanderbilt had not confirmed its involvement or whether information was compromised.