Vanderbilt Cyberattack: US Schools Hit by Ransomware Wave

American schools and universities have had a rough week. In less than five days, a major university in Tennessee, a school district in Idaho and a college in Ohio have all been hit by cyberattacks. Classes were cancelled in one district, and students at Vanderbilt University were told to switch off their devices and stay away from campus Wi-Fi.

The attacks are a fresh warning that schools are now a prime target for criminals. Experts say the incidents show how fast a single attack can shut down the systems that pupils, teachers and parents rely on every day.

What happened at Vanderbilt?

Vanderbilt University in Nashville, Tennessee, announced on Monday morning, 9 November, that it was responding to an active cybersecurity incident. The university said the incident could affect devices, systems and cloud-based services across the campus.

At 10:45am local time, staff and students were told to shut down university devices, disconnect from campus Wi-Fi and stay alert for anything strange on their screens. University IT staff walked into classrooms to warn lecturers not to use school-issued computers. People were also told to close Microsoft Word documents and OneDrive and Dropbox folders.

Classes still went ahead as planned, but many students had trouble with looming assignments and exams. Some crowded into cafes near the campus to find an internet connection. The attack also blocked some students from registering for spring classes, with the registration window closing on Friday.

By 7:15pm on Monday, campus Wi-Fi was back. By Tuesday morning, the university had restored email, Zoom, Brightspace, the Okta login system and enrolment services. But most other systems stayed restricted, and officials warned that full recovery could take several weeks.

Who is behind the attack?

A ransomware gang calling itself BYOD has claimed responsibility for the Vanderbilt attack. The group says it locked the university’s databases and stole more than one million Social Security numbers, along with names, email addresses, phone numbers and student and staff records.

Those claims have not been independently verified. The gang has published no sample files, and Vanderbilt has not confirmed that the group was involved or that any data was stolen. The university has also not said whether a ransom was paid, or given a date for full restoration.

BYOD is a new group that emerged in September. It has also claimed recent attacks on Michigan State University and the University of New Mexico Health Sciences Center. The New Mexico attack in late October forced the cancellation of surgeries and the diversion of ambulances, although all clinical operations there are now fully working again.

Schools in Idaho and Ohio also hit

Vanderbilt was not the only victim. On 10 November, New Plymouth School District in Idaho found a cybersecurity threat and stopped using district computers and network systems. Classes were cancelled across the district’s elementary, middle and high schools, with lessons set to restart on 16 November. As of 11 November, the district had not said how the attack happened or whether student or staff data was affected.

A day later, Wilmington College in Ohio closed at noon while it investigated a possible network security incident. In Virginia, Richmond Public Schools issued a fresh update on 12 November about an attack first found on 21 October, after personal information appeared on the dark web.

There is no confirmed evidence that the incidents are linked or part of a coordinated campaign against American education. But the cluster of cases in a single week has alarmed school leaders. The US Cybersecurity and Infrastructure Security Agency added four flaws to its list of actively exploited vulnerabilities on 9 November, and six more the next day, although no link has been established between those flaws and these attacks.

Why schools are an easy target

Schools hold large amounts of personal data, from pupil records to staff payroll details, yet many have small IT teams and tight budgets. When systems go down, the damage is instant: lessons stop, parents cannot be contacted and exams are put at risk.

Technology is now central to learning, which makes the stakes higher than ever. Only days ago, 300 Experts Urge Pause on England AI Tutor Trial reported how more than 300 experts asked England to pause a plan to give AI tutoring tools to disadvantaged pupils. The Vanderbilt attack shows the other side of the same coin: when schools depend on digital systems, they also depend on keeping those systems safe.

For now, Vanderbilt says it is working with government agencies and partners to manage the situation. Parents and students have been told to watch for official updates and to report anything unusual on their devices at once.

Sources: Inside Higher Ed, Infosecurity Magazine, Neowin, EdCircuit