Vanderbilt University said in a 9 November 2026 update that it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it. The university asked all members of its community to shut down university devices, disconnect from university WiFi and remain extremely vigilant, and listed signs to watch for, including unexpected pop-ups or security notifications, unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage, files unexpectedly moved, deleted, renamed or modified, and unexpected password or authentication requests.

Anyone who sees such activity should not click links or prompts or try to fix it, should shut the device down immediately and should contact the IT Service Desk from a separate device or phone. (source: Vanderbilt University)

Correction (10 Nov 2026): an earlier version of this card repeated a ransomware group's leak-site listing and data claims as reported by The Record; Vanderbilt has not confirmed them, so under Cyberstack's hard-facts policy that sentence was removed. (source: https://therecord.media/vanderbilt-cyberattack-ransomware-alert)

UPDATE (11 Nov 2026): In an update headed 6 p.m., Nov. 10 (the page gives no time zone), Vanderbilt said its IT team continues to focus on containment and on determining what data, if any, may have been accessed, and that it anticipates it may take multiple weeks to fully restore normal operations across all systems.

It said students, faculty and staff may resume using Vanderbilt devices and should log a help desk ticket immediately if they notice abnormal or suspicious activity they have not already reported; campus Wi-Fi, Okta (with MFA), Vanderbilt email, CampusPrint, Brightspace, Zoom and YES are available, and all other Vanderbilt systems and applications remain restricted. (source: Vanderbilt University)